In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by a vulnerability as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager Ops Center     (component: Signaling (dojo)). The supported version that is affected is 12.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Enterprise Manager Ops Center accessible data.
    (CVE-2020-5258)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
    Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic     Server. (CVE-2022-21306)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web     Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base     Score 7.5 (Confidentiality impacts). (CVE-2022-21371)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples).
    Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle WebLogic Server accessible data. (CVE-2022-21292)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is affected by multiple vulnerabilities.

  - Component: WebCenter Sites (Terracotta Quartz Scheduler)). The supported   versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable   vulnerability allows unauthenticated attacker with network access via HTTP to   compromise Oracle WebCenter Sites. Successful attacks of this vulnerability   can result in takeover of Oracle WebCenter Sites. (CVE-2019-13990)

  - Component: WebCenter Sites (XStream)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows low privileged attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in takeover of Oracle WebCenter Sites. (CVE-2021-29505)

  - Component: WebCenter Sites (dojo)). The supported versions that are   affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability   allows unauthenticated attacker with network access via HTTP to compromise   Oracle WebCenter Sites. Successful attacks of this vulnerability can result   in unauthorized creation, deletion or modification access to critical data or   all Oracle WebCenter Sites accessible data. (CVE-2020-5258)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

The 17.12, 18.8, 19.12, and 20.12 versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Primavera Unifier. (CVE-2020-36189)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core     (Apache PDFbox)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Primavera     Unifier executes to compromise Primavera Unifier. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.
    (CVE-2021-27906)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core UI     (dojo)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Primavera Unifier accessible data. (CVE-2020-5258)

  - Security-in-Depth issue in the Oracle Spatial and Graph Network Data Model (jackson-databind) component of     Oracle Database Server. This vulnerability cannot be exploited in the context of this product.
    (CVE-2020-25649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 8.0.x prior to and including 8.0.20. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2020 Critical Patch Update advisory:

  -  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).
  Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged   attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in takeover of MySQL Server. (CVE-2020-14697, CVE-2020-14678)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions   that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with   network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can   result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14680)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported   versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged   attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL   Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2020-14651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The following CVEs were reported against dojo :

CVE-2020-5258

In affected versions of dojo, the deepCopy method is vulnerable to Prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.

CVE-2020-5259

The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values.

For Debian 8 'Jessie', these problems have been fixed in version 1.10.2+dfsg-1+deb8u3.

We recommend that you upgrade your dojo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
170174	Oracle Enterprise Manager Ops Center UI and Other Patches (July 2021 CPU)	Nessus	Misc.	high
157127	Oracle WebLogic Server (Jan 2022 CPU)	Nessus	Misc.	critical
154418	Oracle WebCenter Sites Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Windows	critical
151973	Oracle Primavera Unifier (Jul 2021 CPU)	Nessus	CGI abuses	high
138560	MySQL 8.0.x < 8.0.21 Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	high
134431	Debian DLA-2139-1 : dojo security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-5258

high

Tenable Plugins

high

critical

critical

high

high

high