MySQL Enterprise Monitor 3.4.x < 3.4.10 / 4.x < 4.0.7 / 8.x < 8.0.3 Multiple Vulnerabilities (Oct 2018 CPU)
critical Nessus Plugin ID 138901
Language:
Synopsis
MySQL Enterprise Monitor running on the remote host is affected by multiple vulnerabilitiesDescription
According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the following vulnerabilities in its subcomponents:- Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace. (CVE-2018-11776)
- The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue. (CVE-2018-8014)
- Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted. (CVE-2018-1258)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MySQL Enterprise Monitor version 3.4.10, 4.0.7, 8.0.3 or later as referenced in the Oracle security advisory.See Also
Plugin Details
Severity: Critical
ID: 138901
File Name: mysql_enterprise_monitor_8_0_3.nasl
Version: 1.8
Type: remote
Family: CGI abuses
Published: 7/24/2020
Updated: 5/12/2022
Risk Information
VPR
Risk Factor: Critical
Score: 9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: E:H/RL:OF/RC:C
CVSS Score Source: CVE-2018-11776
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:H/RL:O/RC:C
CVSS Score Source: CVE-2018-8014
Vulnerability Information
CPE: cpe:/a:oracle:mysql_enterprise_monitor
Required KB Items: installed_sw/MySQL Enterprise Monitor
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/15/2018
Vulnerability Publication Date: 5/11/2018
CISA Known Exploited Dates: 5/3/2022
Exploitable With
Elliot (Apache Struts 2 Multiple Tags Result Namespace Handling RCE)