Improper input validation in Oracle Application Testing Suite - CVE-2016-4000
Published: January 25, 2020
Vulnerability identifier: #VU24598
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-4000
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Oracle Flow Builder (Jython) component in Oracle Application Testing Suite. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
Affected software
Oracle Application Testing Suite
Oracle Utilities Network Management System
Oracle Banking Platform
Gentoo Linux
Oracle Communications Diameter Signaling Router (DSR)
Enterprise Manager Base Platform
Oracle Utilities Network Management System
Oracle Banking Platform
Gentoo Linux
Oracle Communications Diameter Signaling Router (DSR)
Enterprise Manager Base Platform
How to mitigate CVE-2016-4000
Install updates from vendor's website.
External References
Related Security Bulletins
- Multiple vulnerabilities in Oracle Application Testing Suite
- Gentoo update for Jython
- Multiple vulnerabilities in Oracle Communications Diameter Signaling Router (DSR)
- Multiple vulnerabilities in Enterprise Manager Base Platform
- Improper input validation in Oracle Utilities Network Management System
- Multiple vulnerabilities in Oracle Banking Platform
- Multiple vulnerabilities in Enterprise Manager Base Platform