CVE-2018-1271: Oracle Application Testing Suite

Medium severity, CVSS 5.9. EPSS: 34.4% chance of exploitation in the next 30 days.

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.

Affected products

  • Oracle Application Testing Suite: version 12.5.0.3 only; version 13.1.0.1 only; version 13.2.0.1 only; version 13.3.0.1 only
  • Oracle Big Data Discovery: version 1.6.0 only
  • Oracle Communications Converged Application Server: before 7.0.0.1 (fixed in 7.0.0.1)
  • Oracle Communications Diameter Signaling Router: before 8.3 (fixed in 8.3)
  • Oracle Communications Performance Intelligence Center: before 10.2.1 (fixed in 10.2.1)
  • Oracle Communications Policy Management: version 12.5.0 only
  • Oracle Communications Services Gatekeeper: before 6.1.0.4.0 (fixed in 6.1.0.4.0)
  • Oracle Enterprise Manager Ops Center: version 12.2.2 only; version 12.3.3 only
  • Oracle Goldengate For Big Data: version 12.2.0.1 only; version 12.3.1.1 only; version 12.3.2.1 only
  • Oracle Health Sciences Information Manager: version 3.0 only
  • Oracle Healthcare Master Person Index: version 3.0 only; version 4.0 only
  • Oracle Insurance Calculation Engine: from 11.0.0, up to and including 11.3.1; version 10.1.1 only; version 10.2 only; version 10.2.1 only
  • Oracle Insurance Rules Palette: version 10.0 only; version 10.1 only; version 10.2 only; version 11.0 only; version 11.1 only
  • Oracle Primavera Gateway: version 15.2 only; version 16.2 only; version 17.12 only
  • Oracle Rapid Planning: version 12.1 only; version 12.2 only
  • Oracle Retail Back Office: version 14.0 only; version 14.1 only
  • Oracle Retail Central Office: version 14.0 only; version 14.1 only
  • Oracle Retail Customer Insights: version 15.0 only; version 16.0 only
  • Oracle Retail Integration Bus: version 14.0.1 only; version 14.0.2 only; version 14.0.3 only; version 14.0.4 only; version 14.1.1 only; version 14.1.2 only; …
  • Oracle Retail Open Commerce Platform: version 5.3.0 only; version 6.0.0 only; version 6.0.1 only
  • Oracle Retail Order Broker: version 5.1 only; version 5.2 only; version 15.0 only; version 16.0 only
  • Oracle Retail Point-Of-Sale: version 14.0 only; version 14.1 only
  • Oracle Retail Predictive Application Server: version 14.0 only; version 14.1 only; version 15.0 only; version 16.0 only
  • Oracle Retail Returns Management: version 14.0 only; version 14.1 only
  • Oracle Retail Xstore Point Of Service: version 7.1 only
  • and 3 more

Published 2018-04-06. Last modified 2026-06-17.