vulnwire
5.7med

CVE-2016-5537

Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known

Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this issue is a directory traversal vulnerability which allows local users with certain permissions to write to arbitrary files and consequently gain privileges via a .. (dot dot) in a archive entry in a ZIP file imported as a project.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

1.04% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.7CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

References

  • oracle.com /technetwork/security-advisory/cpuoct2016-2881722.html · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/40588/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • securityfocus.com /archive/1/539615/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/93686 · vdb-entry, x_refsource_BID, x_transferred
  • hyp3rlinx.altervista.org /advisories/ORACLE-NETBEANS-IDE-DIRECTORY-TRAVERSAL.txt · x_refsource_MISC, x_transferred
  • securitytracker.com /id/1037051 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • packetstormsecurity.com /files/139259/Oracle-Netbeans-IDE-8.1-Directory-Traversal.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.