Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-0492 — Oracle Application Testing Suite vulnerability

6 documents5 sources

Severity

6.4MEDIUMNVD

EPSS

91.5%

top 0.33%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Oracle Application Testing Suite

Timeline

PublishedJan 21

Latest updateMay 17

Description

Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which…

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages1 packages

▶NVDoracle/application_testing_suite12.4.0.2, 12.5.0.2+1

🔴Vulnerability Details

GHSA

GHSA-h7fm-w82j-f8mp: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12↗2022-05-17

▶

OSV

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities↗2022-03-22

▶

CVEList

CVE-2016-0492: Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12↗2016-01-21

▶

💥Exploits & PoCs

Exploit-DB

Oracle Application Testing Suite (ATS) - Arbitrary File Upload (Metasploit)↗2016-05-25

▶

Exploit-DB

Oracle Application Testing Suite (ATS) 12.4.0.2.0 - Authentication Bypass / Arbitrary File Upload↗2016-04-13

▶