A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including     Tika 1.25. Apache Tika users should upgrade to 1.26 or later. (CVE-2021-28657)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including
    Tika 1.25. Apache Tika users should upgrade to 1.26 or later. (CVE-2021-28657)

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - An XML external entity vulnerability in the bundled jackson-databind component which allows an unauthenticated     attacker with network access via HTTP to access, create or delete all data accessible to Oracle WebCenter     Portal. (CVE-2020-25649)

  - Denial of service vulnerabilities in the bundled Apache Tika, jsoup, Netty and Apache Commons Compress components which     allow an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash     of the Oracle WebCenter Portal. (CVE-2020-28657, CVE-2021-36090, CVE-2021-37137, CVE-2021-37714)

  - A path traversal vulnerability in the bundled Apache Commons IO component which allows an unauthenticated attacker     with network access via HTTP to read, update or delete a subset of data accessible to Oracle WebCenter Portal.
    (CVE-2021-29425)

  - A Denial of service vulnerability in the bundled Apache PDFBox component which allows an unauthenticated attacker     with logon to the infrastructure where Oracle WebCenter Portal executes, with human interaction from another user     to cause a hang or frequently repeatable crash of the Oracle WebCenter Portal. (CVE-2021-31912)

  - A cross-site scripting vulnerability in the bundled CKEditor component which allows a low privileged attacker     with network access via HTTP, with human interaction from another user, to read, update or delete a subset of     data accessible to Oracle WebCenter Portal. (CVE-2021-41165)

  - A remote code execution vulnerability in the bundled Apache Log4J component which allows a high privileged     attacker with network access via HTTP to execute arbitrary code on the Oracle WebCenter Portal. (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an     unauthenticated, remote attacker to compromise availability. (CVE-2021-36090)

  - An easily exploitable vulnerability in the Platform, UI (Lodash) component of Primavera Unifier that     allows a remote, high privileged attacker to compromise confidentiality, integrity, and availability.
    (CVE-2021-23337)

  - An easily exploitable vulnerability in the Platform (Apache Tika) component of Primavera unifier that     allows an unauthenticated attacker to compromise availability. (CVE-2021-28657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
258689	Linux Distros Unpatched Vulnerability : CVE-2021-28657	Nessus	Misc.	Local	medium
410621	SCA: security update for org.apache.tika:tika (GHSA-567x-m4wm-87v8)	Tenable Cloud Security	SCA Checks	Local	medium
410621	SCA: security update for org.apache.tika:tika (GHSA-567x-m4wm-87v8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
159954	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2022 CPU)	Nessus	Misc.	Local	high
154262	Oracle Primavera Unifier (Oct 2021 CPU)	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2021-28657

medium

Tenable Plugins

medium

medium

medium

high

high