Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-0491 — Oracle Application Testing Suite vulnerability

5 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
88.4%
top 0.50%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Oracle Application Testing Suite
Timeline
PublishedJan 21
Latest updateMay 17

Description

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) charact…

CVSS vector

AV:N/AC:L/C:N/I:P/A:PExploitability: 10.0 | Impact: 4.9

Affected Packages1 packages

▶NVDoracle/application_testing_suite12.4.0.2, 12.5.0.2+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-ff4f-6x55-3ppq: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12↗2022-05-17
▶
CVEList
CVE-2016-0491: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12↗2016-01-21
▶

💥Exploits & PoCs

2
Exploit-DB
Oracle Application Testing Suite (ATS) - Arbitrary File Upload (Metasploit)↗2016-05-25
▶
Exploit-DB
Oracle Application Testing Suite (ATS) 12.4.0.2.0 - Authentication Bypass / Arbitrary File Upload↗2016-04-13
▶
CVE-2016-0491 — Oracle vulnerability | cvebase