CVE-2016-0489: Medium severity oracle application testing suite vulnerability
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0489?
The severity of CVE-2016-0489 is not explicitly stated, but it affects confidentiality, integrity, and availability of the system.
How do I fix CVE-2016-0489?
To fix CVE-2016-0489, it is recommended to apply the relevant security patches provided by Oracle for the affected versions of the Oracle Application Testing Suite.
What versions of Oracle Application Testing Suite are affected by CVE-2016-0489?
CVE-2016-0489 affects Oracle Application Testing Suite versions 12.4.0.2 and 12.5.0.2.
Who can be impacted by CVE-2016-0489?
Remote authenticated users may be impacted by CVE-2016-0489 through unknown vectors related to Test Manager for Web Apps.
What components are impacted by CVE-2016-0489?
CVE-2016-0489 specifically impacts the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control.