Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and
    EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them
    vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators,
    typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this
    vulnerability (the extent of it will depend on the user under which the application is running). From
    Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled
    on the impacted operators. (CVE-2022-39135)

The version of IBM Cognos Analytics installed on the remote host is 11.1.x prior to 11.1.7 Fix Pack 7 or 11.2.x prior to 11.2.4 FP1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - GNOME libxml2 could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free     flaw in the xmlXIncludeDoProcess() function in xinclude.c. By sending a specially-crafted file, an attacker could     exploit this vulnerability to execute arbitrary code on the system. (CVE-2021-3518)

  - Node.js could allow a local attacker to gain elevated privileges on the system, caused by the DLL search order     hijacking of providers.dll. By placing a specially crafted file, an attacker could exploit this vulnerability     to escalate privileges. (CVE-2022-32223)

  - Node.js marked module is vulnerable to a denial of service, caused by a regular expression denial of service     (ReDoS) flaw in inline.reflinkSearch. By sending a specially-crafted regex input, a remote attacker could exploit     this vulnerability to cause a denial of service condition. (CVE-2022-21681)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the April 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including following that are remotely exploitable:

  - Vulnerability in Security and Provisioning component of Oracle Essbase version 21.4. The public API function BIO_new_NDEF is     a helper function used for streaming ASN.1 data via a BIO. Under certain conditions, the BIO chain is not properly cleaned up     and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. This will most likely     result in a crash. (CVE-2023-0215)

  - Vulnerability in Security and Provisioning component of Oracle Essbase version 21.4. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Essbase accessible data. (CVE-2023-21942, CVE-2023-21943, CVE-2023-21944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
414539	SCA: security update for org.apache.calcite:calcite-core (GHSA-fj2m-w3wv-x9pr)	Tenable Cloud Security	SCA Checks	critical
414539	SCA: security update for org.apache.calcite:calcite-core (GHSA-fj2m-w3wv-x9pr)	Tenable Self-Hosted Container Security	SCA Checks	critical
175429	IBM Cognos Analytics Multiple Vulnerabilities (6986505)	Nessus	CGI abuses	critical
174567	Oracle Essbase (April 2023 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2022-39135

critical

Tenable Plugins

critical

critical

critical

critical