Oracle Business Intelligence Publisher Multiple Vulnerabilities (July 2018 CPU)

high Nessus Plugin ID 119940

Language:

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.180717 or 11.1.1.9.x prior to 11.1.1.9.180717, similarly, versions 12.2.1.2.x prior to 12.2.1.2.180717 and 12.2.1.3.x prior to 12.2.1.3.180717 are affected as noted in the July 2018 Critical Patch Update advisory. The Oracle Business Intelligence Publisher installed on the remote host is affected by multiple vulnerabilities:

- A vulnerability exists on the Layout Tools, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker can exploit the vulnerability via HTTP access to compromise BI Publisher. A successful attack could result in an unauthorized creation, deletion or modification of critical data on BI Publisher including read data to a subset of information (CVE-2018-2900).

- A vulnerability exists on the Web Server, Oracle BI Publisher component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can easily exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2925).

- A vulnerability exists on the BI Publisher Security, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2958).
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the July 2018 Oracle Critical Patch Update advisory.

Plugin Details

Severity: High

ID: 119940

File Name: oracle_bi_publisher_jul_2018_cpu.nasl

Version: 1.6

Type: combined

Agent: windows, macosx, unix

Family: Misc.

Published: 12/28/2018

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2018-2958

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:business_intelligence_publisher

Required KB Items: installed_sw/Oracle Business Intelligence Publisher

Exploit Ease: No known exploits are available

Patch Publication Date: 7/17/2018

Vulnerability Publication Date: 7/17/2018

Reference Information

CVE: CVE-2018-2900, CVE-2018-2925, CVE-2018-2958

BID: 104767

Detections

Analytics