In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux     application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a     locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux     application, or overwrite arbitrary files with multipart request data. (CVE-2021-22118)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux
    application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a
    locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux
    application, or overwrite arbitrary files with multipart request data. (CVE-2021-22118)

The 8.0.25 versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Spring Security)). Supported versions that are affected are 8.0.25 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor. (CVE-2021-22112)

  - Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications     (component: RPAS Fusion Client (Spring Framework)). Supported versions that are affected are 14.1.3,     15.0.3 and 16.0.3. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Retail Predictive Application Server executes to compromise Oracle Retail     Predictive Application Server. Successful attacks of this vulnerability can result in takeover of Oracle     Retail Predictive Application Server. (CVE-2021-22118)

  - Vulnerability in the MySQL Workbench product of Oracle MySQL (component: MySQL Workbench (OpenSSL)).
    Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via MySQL Workbench to compromise MySQL Workbench. Successful     attacks of this vulnerability can result in unauthorized access to critical data or complete access to all     MySQL Workbench accessible data and unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Workbench. (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252494	Linux Distros Unpatched Vulnerability : CVE-2021-22118	Nessus	Misc.	high
415103	SCA: security update for org.springframework:spring-web (GHSA-gfwj-fwqj-fp3v)	Tenable Cloud Security	SCA Checks	high
415103	SCA: security update for org.springframework:spring-web (GHSA-gfwj-fwqj-fp3v)	Tenable Self-Hosted Container Security	SCA Checks	high
154267	Oracle MySQL Enterprise Monitor (Oct 2021 CPU)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2021-22118

high

Tenable Plugins

high

high

high

high