Detections
Analytics
Oracle Application Testing Suite Multiple Vulnerabilities (April / July 2018 CPU)
critical Nessus Plugin ID 111210
Language:
Synopsis
The remote host has a web application installed that is affected by multiple vulnerabilities.Description
The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities :- A remote code execution vulnerability exists in Apache Log4j 2.x before 2.8.2 due to the ability to receive serialized log events from another application. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2017-5645)
- A remote code execution vulnerability exists in Spring Framework due to the exposure of STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host. (CVE-2018-1275)
Solution
Apply the appropriate patch according to the April / July 2018 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: Critical
ID: 111210
File Name: oracle_oats_cpu_jul_2018.nasl
Version: 1.5
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 7/20/2018
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-1275
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:application_testing_suite
Required KB Items: installed_sw/Oracle Application Testing Suite
Exploit Ease: No known exploits are available
Patch Publication Date: 7/17/2018
Vulnerability Publication Date: 7/17/2018
Reference Information
CVE: CVE-2017-5645, CVE-2018-1275