Oracle Application Testing Suite UploadServlet filename Directory Traversal (CVE-2016-0490)

A directory path traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing the HTTP request header filename. A remote unauthenticated attacker can exploit this vulnerability by sending a malicious request to th...

CVE-2016-0490

CVE-2016-0490 concerns Oracle Application Testing Suite within Oracle Enterprise Manager Grid Control (versions 12.4.0.2 and 12.5.0.2). Public sources describe a directory traversal flaw in the UploadServlet servlet, triggered via crafted filename headers, enabling remote attackers to upload and ...