Description

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker having Load Testing for Web Apps privilege with network access via HTTPS to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:17:42.743Z",
  "pubdate": "2026-08-18T21:17:42.743Z",
  "executiveSummary": "A vulnerability exists in Oracle Application Testing Suite affecting version 13.3.0.1 that allows a low-privileged attacker to achieve a complete system takeover. The vulnerability presents a severe risk to organizational security, impacting confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.5.\nExploitation of this vulnerability requires network access via HTTPS and specific low-level privileges, specifically the Load Testing for Web Apps privilege. Despite the high attack complexity metric, successful exploitation results in the total compromise of the affected Oracle Application Testing Suite deployment, granting the adversary full control over the underlying application and its hosted data.",
  "technicalDetails": "The vulnerability resides within Oracle Application Testing Suite version 13.3.0.1, specifically affecting the application's access control mechanisms and request handling logic associated with the Load Testing for Web Apps component.\nAttackers initiate the attack sequence by leveraging network access via the HTTPS protocol. The adversary must authenticate with low privileges, specifically holding the Load Testing for Web Apps privilege within the application.\nDue to high attack complexity (AC:H), the exploitation methodology requires specific preconditions or precise timing conditions to bypass intended security controls. Once these conditions are met, the low-privileged user can interact with vulnerable internal functions or APIs that fail to properly validate user authorization or sanitize input parameters.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the network-accessible HTTPS interface using legitimate credentials associated with the required low-level privilege. 2) The attacker crafts and transmits a specialized payload targeted at the vulnerable Load Testing for Web Apps component. 3) The application processes the malicious payload without adequate authorization enforcement, leading to memory corruption, logic bypass, or insecure deserialization depending on the exact implementation flaw. 4) The execution of the payload grants the attacker elevated capabilities within the JVM or application context.\nThe post-exploitation impact includes the complete takeover of Oracle Application Testing Suite (C:H, I:H, A:H), allowing the adversary to read sensitive data, manipulate system integrity, and disrupt availability services."
}