VIR Vulnerability Intelligence Relay

CVE-2016-1183

low
Published 2016-06-19 · Modified 2026-05-06
CVSS v3
3.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2
4.3
VIR risk
3.7

Description

NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.

Predictions

Exploit likelihood
47%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: vultures@jpcert.or.jp — http://www.fujitsu.com/jp/products/software/resources/condition/security/vulnerabilities/2016/index.html#CVE-2016-1183

vendor Authored 2026-05-27

Vendor advisory: vultures@jpcert.or.jp — http://jvndb.jvn.jp/jvndb/JVNDB-2016-000098

vendor Authored 2026-05-27

Vendor advisory: vultures@jpcert.or.jp — http://jvn.jp/en/jp/JVN74659077/index.html

Application impact
VendorProductVersionsFixed
nttdataterasoluna_server_framework_for_java_web2.0.0.1
nttdataterasoluna_server_framework_for_java_web2.0.0.2
nttdataterasoluna_server_framework_for_java_web2.0.1.0
nttdataterasoluna_server_framework_for_java_web2.0.2.0
nttdataterasoluna_server_framework_for_java_web2.0.5.1
nttdataterasoluna_server_framework_for_java_web2.0.5.2
nttdataterasoluna_server_framework_for_java_web2.0.5.3
nttdataterasoluna_server_framework_for_java_web2.0.6.1

References

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.