CVE-2016-0491 File upload in n/a
Remote authenticated attackers can upload and execute arbitrary files via the UploadFileAction servlet, compromising integrity and availability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-0491?
CVE-2016-0491 is a medium-severity vulnerability in Oracle Application Testing Suite, published on 21 Jan 2016. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
Which versions are affected by CVE-2016-0491?
It affects 1 product.
Products include Oracle Application Testing Suite.
How do I fix CVE-2016-0491?
No fix has been published for CVE-2016-0491 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-0491 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-0491 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in Oracle Application Testing Suite
- CVE-2026-35290 Auth bypass in Oracle Application Testing Suite
- CVE-2026-46876 Auth bypass in Oracle Application Testing Suite
- CVE-2026-46924 Auth bypass in Oracle Application Testing Suite
- CVE-2019-2904 Auth bypass in Enterprise Repository
- CVE-2018-1275 Spring Framework has Improperly Implemented Security Check for Standard
Sources
Also known as GHSA-ff4f-6x55-3ppq.