The remote host contains a Spring Framework version that is prior to 5.2.20 or 5.3.x prior to 5.3.17. It is, therefore, affected by denial of service vulnerability. A remote, authenticated attacker could provide a specially crafted SpEL as a routing expression that may result in denial of service condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5555 advisory.

  - nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

  - springframework: malicious input leads to insertion of additional log entries (CVE-2021-22096)

  - nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623)

  - apache-commons-compress: infinite loop when reading a specially crafted 7Z archive (CVE-2021-35515)

  - apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive     (CVE-2021-35516)

  - apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive     (CVE-2021-35517)

  - apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive     (CVE-2021-36090)

  - spring-expression: Denial of service via specially crafted SpEL expression (CVE-2022-22950)

  - semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri     encoding (CVE-2022-31051)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Dell EMC NetWorker installed on the remote Windows host is prior to 19.8. It, therefore, contains a version of Spring Framework that is affected by a denial of service (DoS) vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
161949	Spring Framework < 5.2.20 / 5.3.x < 5.3.17 DoS (CVE-2022-22950)	Nessus	Misc.	6/8/2022	10/4/2022	medium
163260	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022:5555)	Nessus	Red Hat Local Security Checks	7/15/2022	4/28/2024	high
168650	Dell EMC NetWorker < 19.8 DoS (DSA-2022-350)	Nessus	Windows	12/13/2022	12/14/2022	medium
197084	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8)	Nessus	Misc.	5/15/2024	5/17/2024	critical

Detections

Analytics

Plugins Search

medium

high

medium

critical