Detections
Analytics
Oracle WebCenter Portal Multiple Vulnerabilities (April 2023 CPU)
medium Nessus Plugin ID 174540
Language:
Synopsis
An application server installed on the remote host is affected by multiple vulnerabilities.Description
The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2023 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:- Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework (Netty)). Supported versions that are affected are 12.2.1.4.0. Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a stack overflow error can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. (CVE-2022-41881)
- Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework (XStream)). Supported versions that are affected are 12.2.1.4.0. Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. (CVE-2022-40151)
- Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework (jackson-databind)). Supported versions that are affected are 12.2.1.4.0. In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in 2.13.4.1 and 2.12.17.1 (CVE-2022-42003)
Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patch according to the April 2023 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: Medium
ID: 174540
File Name: oracle_webcenter_portal_cpu_apr_2023.nasl
Version: 1.2
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 4/20/2023
Updated: 4/21/2023
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2022-36033
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:webcenter_portal
Required KB Items: installed_sw/Oracle WebCenter Portal
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/18/2023
Vulnerability Publication Date: 4/18/2023
Reference Information
CVE: CVE-2022-36033, CVE-2022-40151, CVE-2022-41881, CVE-2022-42003
IAVA: 2023-A-0210