A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public. The project was contacted early about this issue and handled it with an exceptional level of professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading Java class documentation to warn about the risks.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8181-1 advisory.

    Jaroslav Lobaevski discovered that ESAPI incorrectly validated directory paths during path verification.
    An attacker could possibly use this issue to bypass directory validation checks, leading to control-flow     bypass. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04     LTS. (CVE-2022-23457)

    Kevin W. Wall and Sebastian Passaro discovered that ESAPI did not properly sanitize javascript URLs     because of an incorrect regular expression. An attacker could possibly use this issue to perform a cross-     site scripting attack. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and     Ubuntu 22.04 LTS. (CVE-2022-24891)

    Longlong Gong discovered that ESAPI did not properly neutralize special elements during SQL injection     defense. A remote attacker could possibly use this issue to perform SQL injection. (CVE-2025-5878)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Enterprise Security API for Java (Legacy))). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of     Primavera Unifier accessible data as well as unauthorized read access to a subset of Primavera Unifier     accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera     Unifier. (CVE-2025-5878)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (FreeType)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in takeover of Primavera Unifier. (CVE-2025-27363)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Apache Commons FileUpload)). Supported versions that are affected are 20.12.0-20.12.16,     21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Primavera Unifier. (CVE-2025-48976)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Commons Lang)). Supported versions that are affected are 20.12.0-20.12.16, 21.12.0-21.12.17,     22.12.0-22.12.15, 23.12.0-23.12.15 and 24.12.0-24.12.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial     DOS) of Primavera Unifier. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in ESAPI esapi-java-legacy and classified as problematic. This issue affects the     interface Encoder.encodeForSQL of the SQL Injection Defense. An attack leads to an improper neutralization     of special elements. The attack may be initiated remotely and an exploit has been disclosed to the public.
    The project was contacted early about this issue and handled it with an exceptional level of     professionalism. Upgrading to version 2.7.0.0 is able to address this issue. Commit ID     f75ac2c2647a81d2cfbdc9c899f8719c240ed512 is disabling the feature by default and any attempt to use it     will trigger a warning. And commit ID e2322914304d9b1c52523ff24be495b7832f6a56 is updating the misleading     Java class documentation to warn about the risks. (CVE-2025-5878)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4246 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4246-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     July 22, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libowasp-esapi-java     Version        : 2.4.0.0-0+deb11u1     CVE ID         : CVE-2022-23457 CVE-2022-24891 CVE-2025-5878     Debian Bug     : 1010339 1109378

    Several security vulnerabilities have been discovered in libowasp-esapi-java,     a Java Enterprise Security API.

    CVE-2022-23457:

        ESAPI (The OWASP Enterprise Security API) is a free, open source, web         application security control library. Prior to this update the default         implementation of `Validator.getValidDirectoryPath(String, String, File,         boolean)` may incorrectly treat the tested input string as a child of the         specified parent directory. This potentially could allow control-flow         bypass checks to be defeated if an attack can specify the entire string         representing the 'input' path.

    CVE-2022-24891:

        There is a potential for a cross-site scripting vulnerability in ESAPI         caused by a incorrect regular expression for onsiteURL in the
        **antisamy-esapi.xml** configuration file that can cause javascript: URLs         to fail to be correctly sanitized.

    CVE-2025-5878:

        This issue affects the interface Encoder.encodeForSQL of the         SQL Injection Defense. An attack leads to an improper neutralization of         special elements. We are not aware of any affected reverse-dependencies in         Debian but if you use ESAPI in a stand-alone project, you should be aware         that the Encoder.encodeForSQL method has been deprecated and will be         removed eventually. In addition the DB2Codec, MySQLCodec and OracleCodec         classes have been deprecated too. We recommend to carefully assess if         your project might be affected by these classes and methods and if you have         to implement additional steps to secure your application. The update does         not automatically protect you from any potential risks.

    For Debian 11 bullseye, these problems have been fixed in version     2.4.0.0-0+deb11u1.

    We recommend that you upgrade your libowasp-esapi-java packages.

    For the detailed security status of libowasp-esapi-java please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libowasp-esapi-java

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
307008	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : ESAPI vulnerabilities (USN-8181-1)	Nessus	Ubuntu Local Security Checks	medium
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
271244	Oracle Primavera Unifier (October 2025 CPU)	Nessus	CGI abuses	medium
247283	Linux Distros Unpatched Vulnerability : CVE-2025-5878	Nessus	Misc.	medium
242493	Debian dla-4246 : libowasp-esapi-java - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2025-5878

medium

Tenable Plugins

medium

high

medium

medium

medium