Path Traversal in Oracle Application_testing_suite
CVE-2018-1271
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served fr…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.357 (98.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Oracle Application_testing_suite — versions 12.5.0.3, 13.1.0.1, 13.2.0.1
- Oracle Big_data_discovery — versions 1.6.0
- Oracle Communications_converged_application_server
- Oracle Communications_diameter_signaling_router
- Oracle Communications_performance_intelligence_center
- Oracle Communications_policy_management — versions 12.5.0
- Oracle Communications_services_gatekeeper
- Oracle Enterprise_manager_ops_center — versions 12.2.2, 12.3.3
- Oracle Goldengate_for_big_data — versions 12.2.0.1, 12.3.1.1, 12.3.2.1
- Oracle Healthcare_master_person_index — versions 3.0, 4.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security_alert@emc.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security_alert@emc.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security_alert@emc.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (Third Party Advisory, x_refsource_MISC)
- security_alert@emc.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- security_alert@emc.com (Patch, Third Party Advisory, x_refsource_MISC)
- security_alert@emc.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-1271?
- CVE-2018-1271 is a medium-severity vulnerability in Oracle Application_testing_suite, classified under Path Traversal. CVSS score: 5.9/10. Published 2018-04-06.
- How severe is CVE-2018-1271?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2018-1271 known to be exploited?
- 28 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.