CVE-2012-3132
MEDIUM · CVSS 6.5EPSS 1.8%EU EUVD
SQL injection vulnerability in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to execute arbitrary SQL commands via vectors involving CREATE INDEX with a CTXSYS.CONTEXT INDEXTYPE and DBMS_STATS.GATHER_TABLE_STATS.
Key facts
- CVSS score
- 6.5 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:L/Au:S/C:P/I:P/A:P- Weakness (CWE)
- CWE-89
- EPSS score
- 1.8% (79th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2012-3110)
- Published
- August 10, 2012
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2012-3110 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- oracle / database server
- oracle / database server
- oracle / database server
- oracle / database server
- oracle / database server
- oracle / database server
References
- http://www.darkreading.com/database-security/167901020/security/news/240004776/hacking-oracle-database-indexes.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://www.networkworld.com/news/2012/072712-black-hat-shark-bitten-security-researcher-261203.html
- http://www.oracle.com/technetwork/topics/security/alert-cve-2012-3132-1721017.html(Vendor Advisory)
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- http://www.securitytracker.com/id?1027367
- http://www.teamshatter.com/topics/general/team-shatter-exclusive/ctxsys-context-privilege-escalation/
- https://blogs.oracle.com/security/entry/security_alert_cve_2012_3132(Vendor Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain