Description

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Testing Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Testing Suite accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-18T21:17:42.620Z",
  "pubdate": "2026-08-18T21:17:42.620Z",
  "executiveSummary": "A security vulnerability has been identified in the Oracle Application Testing Suite, specifically affecting version 13.3.0.1. This flaw allows a low-privileged attacker with specific Load Testing for Web Apps privileges to compromise the application over a network using the HTTP protocol.\nThe vulnerability is characterized by a CVSS 3.1 base score of 7.6, indicating significant risks to data confidentiality and integrity with a scope change (S:C). Successful exploitation requires human interaction from a user other than the attacker. The primary impacts include unauthorized access to critical data or complete access to all data accessible by the Oracle Application Testing Suite, alongside unauthorized update, insert, or delete capabilities for a subset of accessible data.\nGiven the low privilege requirements and network vector, malicious actors can leverage this flaw to escalate their operational capabilities within the affected environment. The necessity of user interaction serves as a primary friction point, but the potential for cross-product scope impact elevates the overall risk profile, necessitating prompt administrative review and hardening.",
  "technicalDetails": "The vulnerability resides within the Oracle Application Testing Suite, specifically impacting version 13.3.0.1. The flaw is exposed via the network attack vector (AV:N), utilizing the HTTP protocol to interact with vulnerable endpoints. Exploitation requires low privileges (PR:L), specifically requiring the attacker to possess the Load Testing for Web Apps privilege.\nThe attack mechanism mandates human interaction (UI:R) from a third-party user, indicating that successful execution likely relies on techniques such as induced navigation or social engineering to trigger the malicious payload within the context of the victim's session. The CVSS vector designates a scope change (S:C), meaning that a successful compromise within the Oracle Application Testing Suite can significantly impact additional downstream or interconnected products outside the primary administrative boundary.\nUpon successful exploitation, the vulnerability inflicts severe consequences on data security. It grants unauthorized read access to critical data or complete access to all data accessible by the Oracle Application Testing Suite (C:H). Additionally, it permits unauthorized modification vectors, specifically enabling unauthorized update, insert, or delete access to a subset of the application's accessible data (I:L). The availability metric remains unaffected (A:N).\nThe attack flow proceeds as follows: 1) An authenticated attacker with low-level Load Testing for Web Apps privileges crafts a malicious request or payload intended for HTTP transmission. 2) The attacker leverages social engineering or other vectors to induce user interaction from an unsuspecting victim. 3) Upon execution via the victim's browser or session, the application processes the request, circumventing intended security boundaries due to insufficient validation or access controls. 4) The scope change property allows the impact to propagate beyond the immediate component. 5) The attacker achieves unauthorized read access to critical data stores alongside limited write and modification capabilities, culminating in a compromised data integrity and confidentiality state."
}