Vulnerability Description
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle | Application Testing Suite | 12.4.0.2 |
References
- http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.htmExploit
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatchVendor Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_uploadThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/81169Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1034734Third Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-047Third Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/39691/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/39852/ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.htmExploit
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlPatchVendor Advisory
- http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_uploadThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/81169Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1034734Third Party AdvisoryVDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-16-047Third Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/39691/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2016-0491?
CVE-2016-0491 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability...
How severe is CVE-2016-0491?
CVE-2016-0491 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-0491?
Check the references section above for vendor advisories and patch information. Affected products include: Oracle Application Testing Suite.