Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NSummary
CVE-2012-0518 is a medium-severity Open Redirect (CWE-601) vulnerability in Oracle Fusion Middleware. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked in the top 9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an unspecified flaw, tracked as CWE-601, in the Oracle Application Server Single Sign-On component of Oracle Fusion Middleware 10.1.4.3.0. It permits remote attackers to affect system integrity through unknown vectors related to redirects and is distinct from CVE-2012-3175. The associated CVSS 3.1 score is 4.7 with an attack vector of network, low complexity, no privileges required, and user interaction needed, resulting in changed scope and limited integrity impact without confidentiality or availability effects.
Remote unauthenticated attackers can exploit the issue by supplying crafted redirect parameters that cause the Single Sign-On service to forward legitimate users to arbitrary destinations under attacker control, thereby compromising the integrity of the authentication flow.
Oracle's October 2012 Critical Patch Update and related Mandriva advisories address the flaw through available patches for the affected Fusion Middleware version. The vulnerability appears in CISA's catalog of known exploited vulnerabilities, confirming observed real-world use.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2012-0550
Vulnerability Data
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
- CWE(s)
- KEV Date Added
- 28 March 2022
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.