The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2022 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener     (Apache HTTP Server)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server.
    CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). (CVE-2021-39275)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module     (cURL)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP     Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1     Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2021-22901)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (Apache     HTTP Server)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP     Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle HTTP Server accessible data and unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle HTTP Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). (CVE-2021-44224)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle HTTP Server (Apr 2022 CPU)

critical Nessus Plugin ID 159947

Version 1.5

Version 1.4

Version 1.5 Nov 1, 2023, 1:41 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202311011341
Version 1.4 Dec 30, 2022, 4:05 PM Required Scan configuration (thorough_tests) Plugin Feed: 202212301605