{"api_version":"1","generated_at":"2026-07-23T12:15:24+00:00","cve":"CVE-2012-3137","urls":{"html":"https://cve.report/CVE-2012-3137","api":"https://cve.report/api/cve/CVE-2012-3137.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2012-3137","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2012-3137"},"summary":{"title":"CVE-2012-3137","description":"The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\"","state":"PUBLISHED","assigner":"oracle","published_at":"2012-09-21 23:55:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-287","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.4","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.exploit-db.com/exploits/22069","name":"http://www.exploit-db.com/exploits/22069","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Oracle Database Authentication Protocol Security Bypass","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular","name":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"title":"Flaw in Oracle Logon Protocol Leads to Easy Password Cracking | threatpost","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","name":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - October 2012","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","name":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Oracle Critical Patch Update - July 2016","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/55651","name":"http://www.securityfocus.com/bid/55651","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Oracle Database Authentication Protocol CVE-2012-3137 Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Support / Security / Advisories /  / MDVSA-2013:150 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html","name":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"title":"Attack Easily Cracks Oracle Database Passwords - Dark Reading","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/","name":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Press/Media Coverage"],"title":"Oracle Database suffers from “stealth password cracking vulnerability” | Ars Technica","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3137","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3137","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"10.2.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"10.2.0.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"10.2.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"11.1.0.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"11.2.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"database_server","cpe6":"11.2.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_p6_enterprise_project_portfolio_management","cpe6":"8.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_p6_enterprise_project_portfolio_management","cpe6":"8.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2012","cve_id":"3137","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"oracle","cpe5":"primavera_p6_enterprise_project_portfolio_management","cpe6":"8.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T19:57:50.340Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"},{"name":"22069","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"http://www.exploit-db.com/exploits/22069"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"},{"name":"55651","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/55651"},{"name":"MDVSA-2013:150","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2012-09-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-25T19:57:01.000Z","orgId":"43595867-4340-4103-b7a2-9a5208d29a85","shortName":"oracle"},"references":[{"tags":["x_refsource_MISC"],"url":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"},{"name":"22069","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"http://www.exploit-db.com/exploits/22069"},{"tags":["x_refsource_MISC"],"url":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"},{"tags":["x_refsource_MISC"],"url":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"},{"name":"55651","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/55651"},{"name":"MDVSA-2013:150","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert_us@oracle.com","ID":"CVE-2012-3137","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html","refsource":"MISC","url":"http://www.darkreading.com/authentication/167901072/security/application-security/240007643/attack-easily-cracks-oracle-database-passwords.html"},{"name":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"},{"name":"22069","refsource":"EXPLOIT-DB","url":"http://www.exploit-db.com/exploits/22069"},{"name":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular","refsource":"MISC","url":"http://threatpost.com/en_us/blogs/flaw-oracle-logon-protocol-leads-easy-password-cracking-092012?utm_source=Threatpost&utm_medium=Tabs&utm_campaign=Today%27s+Most+Popular"},{"name":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/","refsource":"MISC","url":"http://arstechnica.com/security/2012/09/oracle-database-stealth-password-cracking-vulnerability/"},{"name":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html"},{"name":"55651","refsource":"BID","url":"http://www.securityfocus.com/bid/55651"},{"name":"MDVSA-2013:150","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:150"}]}}}},"cveMetadata":{"assignerOrgId":"43595867-4340-4103-b7a2-9a5208d29a85","assignerShortName":"oracle","cveId":"CVE-2012-3137","datePublished":"2012-09-21T23:00:00.000Z","dateReserved":"2012-06-06T00:00:00.000Z","dateUpdated":"2024-08-06T19:57:50.340Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2012-09-21 23:55:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-287","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:10.2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"ED41086B-840A-4B39-B249-461A4B00B57B"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:10.2.0.4:*:*:*:*:*:*:*","matchCriteriaId":"E4AC251D-9313-4A54-9623-51DC0AEC46FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:10.2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"9ACC1D6F-2EDD-4DAA-B9CE-CF516C2B35C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:11.1.0.7:*:*:*:*:*:*:*","matchCriteriaId":"EDEDE937-C3D7-421C-9F70-F546AB823E1D"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:11.2.0.2:*:*:*:*:*:*:*","matchCriteriaId":"3D7157D8-4959-4F6C-BFA0-D80862393AA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database_server:11.2.0.3:*:*:*:*:*:*:*","matchCriteriaId":"165A1F85-076B-4216-8EF8-D67E6EC63A6B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.2:*:*:*:*:*:*:*","matchCriteriaId":"A56DC460-26F5-453E-A5BC-4C60AA3212EB"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.3:*:*:*:*:*:*:*","matchCriteriaId":"A47BF03C-BF18-4477-9DBB-20EFEA53AFAB"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*","matchCriteriaId":"84BF6794-2CE6-407F-B8E0-81871AB7B40B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2012","CveId":"3137","Ordinal":"1","Title":"CVE-2012-3137","CVE":"CVE-2012-3137","Year":"2012"},"notes":[{"CveYear":"2012","CveId":"3137","Ordinal":"1","NoteData":"The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to obtain the session key and salt for arbitrary users, which leaks information about the cryptographic hash and makes it easier to conduct brute force password guessing attacks, aka \"stealth password cracking vulnerability.\"","Type":"Description","Title":"CVE-2012-3137"},{"CveYear":"2012","CveId":"3137","Ordinal":"2","NoteData":"2012-09-21","Type":"Other","Title":"Published"},{"CveYear":"2012","CveId":"3137","Ordinal":"3","NoteData":"2016-11-25","Type":"Other","Title":"Modified"}]}}}