This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object     prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype     instance. (CVE-2021-23413)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object
    prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype
    instance. (CVE-2021-23413)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (FreeType)). Supported versions that are affected are 18.8.0-18.8.18, 19.12.0-19.12.16,     20.12.0-20.12.16, 21.12.0-21.12.14 and 22.12.0-22.12.3. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in takeover of Primavera Unifier. (CVE-2022-27404)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering     (component: User Interface (jsoup)). Supported versions that are affected are 18.8.0-18.8.18, 19.12.0-19.12.16,     20.12.0-20.12.16, 21.12.0-21.12.14 and 22.12.0-22.12.3. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Primavera Unifier,     attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability     can result in unauthorized update, insert or delete access to some of Primavera Unifier accessible data as     well as unauthorized read access to a subset of Primavera Unifier accessible data. (CVE-2022-36033)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: User     Interface (JSZip)). Supported versions that are affected are 18.8.0-18.8.18, 19.12.0-19.12.16,     20.12.0-20.12.16, 21.12.0-21.12.14 and 22.12.0-22.12.3. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks of     this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of Primavera Unifier. (CVE-2021-23413)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250997	Linux Distros Unpatched Vulnerability : CVE-2021-23413	Nessus	Misc.	medium
416349	SCA: security update for jszip (GHSA-jg8v-48h5-wgxg)	Tenable Cloud Security	SCA Checks	medium
416349	SCA: security update for jszip (GHSA-jg8v-48h5-wgxg)	Tenable Self-Hosted Container Security	SCA Checks	medium
174471	Oracle Primavera Unifier (Apr 2023 CPU)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2021-23413

medium

Tenable Plugins

medium

medium

medium

critical