The 13.5.0.0 version of Enterprise Manager Base Platform product of Oracle Enterprise Manager installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory:

  - Vulnerability in the Agent Next Gen (jackson-databind) and Extensibility Framework (jackson-databind)   components of Enterprise Manager Base Platform. Easily exploitable vulnerability allows an unauthenticated   attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful   attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable   crash (complete DOS) of Oracle Enterprise Manager Base Platform. (CVE-2022-42003)

  - Vulnerability in the Agent Next Gen (Jettison) component of Enterprise Manager Base Platform. Easily   exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise   Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized   ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base   Platform. (CVE-2023-1436)

  - Vulnerability in the Log Management component of Enterprise Manager Base Platform. Difficult to exploit   vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle   Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the   attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may   significantly impact additional products (scope change). Successful attacks of this vulnerability can result   in  unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform   accessible data as well as  unauthorized update, insert or delete access to some of Oracle Enterprise   Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial   DOS) of Oracle Enterprise Manager Base Platform. (CVE-2024-20917)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Enterprise Manager Cloud Control (January 2024 CPU)

medium Nessus Plugin ID 189242

Version 1.3