The installation of Oracle Global Lifecycle Management (OPatch) installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues (jackson-databind)). Supported versions that are affected     are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. (CVE-2022-42003)

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues (Apache Mina SSHD)). Supported versions that are affected     are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks     of this vulnerability can result in takeover of Oracle Global Lifecycle Management NextGen OUI Framework.
    (CVE-2022-45047)

  - Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion     Middleware (component: NextGen Installer issues). Supported versions that are affected are Prior to     13.9.4.2.11. Easily exploitable vulnerability allows low privileged attacker with logon to the     infrastructure where Oracle Global Lifecycle Management NextGen OUI Framework executes to compromise     Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Oracle Global Lifecycle Management NextGen OUI Framework. (CVE-2023-21894)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Global Lifecycle Management (OPatch) (Jan 2023 CPU)

critical Nessus Plugin ID 178010

Version 1.1

Version 1.0

Version 1.1 Jul 7, 2023, 2:20 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" set to "Exploits are available") Plugin Feed: 202307071420
Version 1.0 Jul 6, 2023, 12:07 PM New Plugin Feed: 202307061207