common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream
    handler flow, leading to the writing of files to arbitrary locations. (CVE-2020-35460)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote host is 16.x prior to 16.2.16.4 or 17.x prior to 17.12.11.6 or 18.x prior to 18.8.18.3 or 19.x prior to 19.12.13 or 20.x prior to 20.12.1. It is, therefore, affected by  multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (MPXJ)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in takeover of Primavera Unifier.
    (CVE-2020-25020)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core,     Config (Apache Ant)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12 and     20.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Unifier accessible data.
    (CVE-2020-11979)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core     (Apache Commons BeanUtils)). Supported versions that are affected are 16.1, 16.2, 17.7-17.12, 18.8, 19.12     and 20.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Primavera Unifier accessible data as well as unauthorized read     access to a subset of Primavera Unifier accessible data and unauthorized ability to cause a partial denial     of service (partial DOS) of Primavera Unifier. (CVE-2019-10086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
417424	SCA: security update for net.sf.mpxj:mpxj (GHSA-p9j6-4pjr-gp48)	Tenable Cloud Security	SCA Checks	medium
417424	SCA: security update for net.sf.mpxj:mpxj (GHSA-p9j6-4pjr-gp48)	Tenable Self-Hosted Container Security	SCA Checks	medium
145569	Oracle Primavera Unifier (Jan 2021 CPU)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2020-35460

medium

Tenable Plugins

medium

medium

critical