The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener     (OpenSSL)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via TLS to compromise Oracle HTTP Server. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle HTTP Server. (CVE-2024-2511, CVE-2024-4603, CVE-2024-4741)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Plugins (Nghttp2)).     The supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP/2 to compromise Oracle HTTP Server.     Successful attacks of this vulnerability can result in unauthorized ability to cause a partial     denial of service (partial DOS) of Oracle HTTP Server. (CVE-2024-28182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle HTTP Server (October 2024 CPU)

high Nessus Plugin ID 209278

Version 1.3