The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the April 2022 CPU advisory. Specifically:

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: BPM Studio (Apache Groovy)). Supported versions that are affected are 12.2.1.3.0 and     12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Business Process Management Suite executes to compromise Oracle Business     Process Management Suite. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Oracle Business Process Management Suite accessible data.
    (CVE-2020-17521)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Installer (jsoup)). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business     Process Management Suite. (CVE-2021-37714)

  - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware     (component: Runtime Engine (JBoss Enterprise Application Platform)). Supported versions that are affected     are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this     vulnerability can result in takeover of Oracle Business Process Management Suite. (CVE-2022-23305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

Detections

Analytics

Oracle Business Process Management Suite (Apr 2022 CPU)

critical Nessus Plugin ID 159978

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.7 Nov 1, 2023, 1:41 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202311011341
Version 1.6 Oct 24, 2023, 4:27 PM IAVM reference Plugin Feed: 202310241627
Version 1.5 Dec 30, 2022, 4:05 PM Required Scan configuration (thorough_tests) Plugin Feed: 202212301605
Version 1.4 Dec 6, 2022, 2:54 AM Reference Plugin Feed: 202212060254