jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Discussion Forums     (OSCORE)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks     of this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2023-39022)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Development Tools     (Apache Commons BCEL)). The supported version that is affected is 12.2.1.4.0.. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Documaker. Successful attacks     of this vulnerability can result in takeover of Oracle Documaker. (CVE-2022-42920)

  - Security-in-Depth issue in the Oracle Database Workload Manager (jackson-databind) component of Oracle Database     Server. This vulnerability cannot be exploited in the context of this product (CVE-2022-42004)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1265-1 advisory.

  - jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse     untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an     attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to     complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of     service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may     rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread     watchdogs to cap and timeout parse runtimes. (CVE-2021-37714)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2022 CPU advisory. Specifically:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (Apache Groovy)). Supported versions that are affected are 12.2.1.3.0 and     12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Business Process Management Suite executes to compromise Oracle Business     Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Business Process Management Suite accessible data.
    (CVE-2020-17521)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (jsoup)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2021-37714)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (JBoss Enterprise Application Platform)). Supported versions that are affected     are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this     vulnerability can result in takeover of Oracle Business Process Management Suite. (CVE-2022-23305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2022 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - An XML external entity vulnerability in the bundled jackson-databind component which allows an unauthenticated     attacker with network access via HTTP to access, create or delete all data accessible to Oracle WebCenter     Portal. (CVE-2020-25649)

  - Denial of service vulnerabilities in the bundled Apache Tika, jsoup, Netty and Apache Commons Compress components which     allow an unauthenticated attacker with network access via HTTP to cause a hang or frequently repeatable crash     of the Oracle WebCenter Portal. (CVE-2020-28657, CVE-2021-36090, CVE-2021-37137, CVE-2021-37714)

  - A path traversal vulnerability in the bundled Apache Commons IO component which allows an unauthenticated attacker     with network access via HTTP to read, update or delete a subset of data accessible to Oracle WebCenter Portal.
    (CVE-2021-29425)

  - A Denial of service vulnerability in the bundled Apache PDFBox component which allows an unauthenticated attacker     with logon to the infrastructure where Oracle WebCenter Portal executes, with human interaction from another user     to cause a hang or frequently repeatable crash of the Oracle WebCenter Portal. (CVE-2021-31912)

  - A cross-site scripting vulnerability in the bundled CKEditor component which allows a low privileged attacker     with network access via HTTP, with human interaction from another user, to read, update or delete a subset of     data accessible to Oracle WebCenter Portal. (CVE-2021-41165)

  - A remote code execution vulnerability in the bundled Apache Log4J component which allows a high privileged     attacker with network access via HTTP to execute arbitrary code on the Oracle WebCenter Portal. (CVE-2021-44832)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.3, or 2.x prior to 2.319.1.5. It is, therefore, affected by a multiple vulnerabilities, including the following:

  - When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' tar package. (CVE-2021-35517)

  - jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse     untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an     attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to     complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of     service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may     rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread     watchdogs to cap and timeout parse runtimes. (CVE-2021-37714)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, Data Persistence (OWASP Java HTML Sanitizer)). Supported versions that are affected are     17.7-17.12, 18.8, 19.12, 20.12 and 21.12. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in takeover of Primavera Unifier. (CVE-2021-42575)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform,Data Parsing (jsoup)). Supported versions that are affected are 20.12 and 21.12. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized ability to cause a     hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-37714)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Thirdparty Jars (Apache Log4j)). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and     14.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover     of Oracle WebLogic Server. (CVE-2021-44832)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5151 advisory.

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

  - wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

  - wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

  - jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

  - xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5149 advisory.

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

  - wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

  - wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

  - jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

  - xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5150 advisory.

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

  - wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

  - wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

  - jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

  - xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4676 advisory.

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)

  - undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

  - wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

  - jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4677 advisory.

  - resteasy: Error message exposes endpoint class information (CVE-2021-20289)

  - mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)

  - undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

  - wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

  - jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183294	Oracle WebCenter Portal Multiple Vulnerabilities (October 2023 CPU)	Nessus	Misc.	critical
160048	SUSE SLED15 / SLES15 Security Update : jsoup, jsr-305 (SUSE-SU-2022:1265-1)	Nessus	SuSE Local Security Checks	high
159978	Oracle Business Process Management Suite (Apr 2022 CPU)	Nessus	Misc.	critical
159954	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2022 CPU)	Nessus	Misc.	high
158092	Jenkins Enterprise and Operations Center < 2.277.43.0.3 / 2.319.1.5 Multiple Vulnerabilities (CloudBees Security Advisory 2021-12-01)	Nessus	CGI abuses	high
156832	Oracle Primavera Unifier (Jan 2022 CPU)	Nessus	CGI abuses	critical
156111	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 (Moderate) (RHSA-2021:5151)	Nessus	Red Hat Local Security Checks	high
156109	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 (Moderate) (RHSA-2021:5149)	Nessus	Red Hat Local Security Checks	high
156106	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7 (Moderate) (RHSA-2021:5150)	Nessus	Red Hat Local Security Checks	high
155386	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 (Moderate) (RHSA-2021:4676)	Nessus	Red Hat Local Security Checks	high
155365	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8 (Moderate) (RHSA-2021:4677)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-37714

high

Tenable Plugins

critical

high

critical

high

high

critical

high

high

high

high

high