Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (JDBC)). The supported version that is affected is 12.4.0.0. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via Oracle Net to compromise Enterprise Manager Ops     Center. Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in Enterprise Manager Ops Center, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops     Center. (CVE-2021-2351)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Python)). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Ops Center.
    Successful attacks of this vulnerability can result in takeover of Enterprise Manager Ops Center.
    (CVE-2021-3177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle GoldenGate installed on the remote host is affected by the following vulnerabilities as noted in the January 2022 CPU advisory :

  - Vulnerability in Oracle GoldenGate (component: Build Request (Apache Xerces-C++)). The supported version that is     affected is Prior to 21.4.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in takeover of     Oracle GoldenGate. (CVE-2018-1311)

  - Vulnerability in Oracle GoldenGate (component: GG Market Place for Support (nginx)). The supported version that is     affected is Prior to 21.4.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via UDP to compromise Oracle GoldenGate. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Oracle GoldenGate accessible data as well as     unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data and unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate. (CVE-2021-23017)

  - Vulnerability in Oracle GoldenGate (component: Database (OCCI)). Supported versions that are affected are Prior to     21.5.0.0.220118, Prior to 19.1.0.0.220118 and Prior to 12.3.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via Oracle Net to compromise Oracle GoldenGate. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle GoldenGate,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result in     takeover of Oracle GoldenGate. (CVE-2021-2351)

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Web Server     (Apache HTTP Server)). The supported version that is affected is 5.6. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Secure Global Desktop.
    While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional     products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Secure     Global Desktop. (CVE-2021-40438)

  - Vulnerability in the Oracle StorageTek ACSLS product of Oracle Systems (component: Software (JDBC)). The     supported version that is affected is 8.5.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via Oracle Net to compromise Oracle StorageTek ACSLS. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle     StorageTek ACSLS, attacks may significantly impact additional products (scope change). Successful attacks     of this vulnerability can result in takeover of Oracle StorageTek ACSLS. (CVE-2021-2351)

  - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI     (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter     Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1     Base Score 6.6 (Confidentiality, Integrity and Availability impacts). (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by a vulnerability as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Load Testing     for Web Apps (JDBC, OCCI)). The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite.
    Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in     Oracle Application Testing Suite, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Oracle Application Testing Suite. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by a vulnerability as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and     Engineering (component: Web Access (Apache Log4j)). Supported versions that are affected are 19.12.0.0-19.12.18.0,     20.12.0.0-20.12.12.0 and 21.12.0.0. Difficult to exploit vulnerability allows high privileged attacker with network     access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this     vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management. Note: This patch also     addresses vulnerabilities CVE-2021-44228 and CVE-2021-45046. Customers need not apply the patches/mitigations of     Security Alert CVE-2021-44228 and CVE-2021-45046 for this product. (CVE-2021-44832)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and     Engineering (component: Web Access (JDBC)). Supported versions that are affected are 17.12.0.0-17.12.20.0,     18.8.0.0-18.8.24.0, 19.12.0.0-19.12.17.0 and 20.12.0.0-20.12.9.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via Oracle Net to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while     the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in takeover of Primavera P6 Enterprise     Project Portfolio Management. (CVE-2021-2351)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, Data Persistence (OWASP Java HTML Sanitizer)). Supported versions that are affected are     17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in takeover of Primavera Unifier. (CVE-2021-42575)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform,Data Parsing (jsoup)). Supported versions that are affected are 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-37714)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover     of Oracle WebLogic Server. (CVE-2021-44832)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Primavera Gateway installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - Vulnerability in the Oracle Retail Store Inventory Management product of Oracle Retail Applications     (component: SIM Integration (JDBC)). Supported versions that are affected are 14.1, 15.0 and 16.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to     compromise Oracle Retail Store Inventory Management. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Oracle Retail Store Inventory Management,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result     in takeover of Oracle Retail Store Inventory Management. (CVE-2021-2351)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: File     Management (Apache Commons Compress)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12     and 20.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-36090)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, UI (Lodash)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise     Primavera Unifier. (CVE-2021-23337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
170273	Oracle Enterprise Manager Ops Center UI and Other Patches (January 2022 CPU)	Nessus	Misc.	critical
168057	Oracle GoldenGate Multiple Vulnerabilities (January 2022 CPU)	Nessus	Misc.	high
159930	Oracle Enterprise Manager Ops Center (Apr 2022 CPU)	Nessus	Misc.	critical
156933	Oracle Application Testing Suite (Jan 2022 CPU)	Nessus	Misc.	high
156891	Oracle Primavera P6 Enterprise Project Portfolio Management (Jan 2022 CPU)	Nessus	CGI abuses	high
156832	Oracle Primavera Unifier (Jan 2022 CPU)	Nessus	CGI abuses	critical
154297	Oracle Primavera Gateway (Oct 2021 CPU)	Nessus	CGI abuses	high
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	critical

Detections

Analytics

CVE-2021-2351

high

Tenable Plugins

critical

high

critical

high

high

critical

high

critical