Oracle ATS DownloadServlet scheduleReportName Directory Traversal (CVE-2016-0481)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter scheduleReportName. A remote unauthenticated attacker can exploit this vulnerability...

CVE-2016-0481

CVE-2016-0481 is a directory traversal vulnerability in Oracle’s Application Testing Suite (ATS) DownloadServlet affecting the /otm/download endpoint via the scheduleReportName parameter. The connected advisories (CPAI-2016-0306) describe the flaw as due to insufficient input validation, enabling...