Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

The remote SUSE Linux SLES11 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2019:14044-1 advisory.

  - Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution     (CVE-2016-1000031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 13.3.0.0, 13.4.0.0, and 13.2.1.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Reporting Framework (Apache Camel)). Supported versions that are affected are 13.3.0.0 and 13.4.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     takeover of Enterprise Manager Base Platform.

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Reporting Framework (Apache Commons FileUpload)). Supported versions that are affected are 13.3.0.0 and     13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     takeover of Enterprise Manager Base Platform.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.15, 8.5.0.x prior to 8.5.5.13 or 9.0.x prior to 9.0.0.7. It is, therefore, affected by a remote code execution vulnerability due to improper deserialization of untrusted data in the DiskFileItem class of the FileUpload library in the Apache Commons FileUpload subcomponent. An unauthenticated, remote attacker can exploit this to execute arbitrary code under the context of the current process.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the MapViewer (Apache Commons     FileUpload) component of Oracle Database Server.
    Supported versions that are affected are 12.2.0.1, 18c     and 19c. Easily exploitable vulnerability allows low     privileged attacker having Valid User Account privilege     with network access via HTTP to compromise MapViewer     (Apache Commons FileUpload). Successful attacks of this     vulnerability can result in takeover of MapViewer     (Apache Commons FileUpload). Note: MapViewer is not     deployed with a default installation. To use MapViewer     the customer needs to re-deploy MapViewer EAR file into     Oracle WebLogic Server. CVSS 3.1 Base Score 8.8     (Confidentiality, Integrity and Availability impacts).
    (CVE-2016-1000031)

  - Vulnerability in the Java VM component of Oracle     Database Server. Supported versions that are affected     are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c. Difficult     to exploit vulnerability allows low privileged attacker     having Create Session, Create Procedure privilege with     network access via multiple protocols to compromise Java     VM. Successful attacks require human interaction from a     person other than the attacker and while the     vulnerability is in Java VM, attacks may significantly     impact additional products. Successful attacks of this     vulnerability can result in takeover of Java VM. CVSS     3.1 Base Score 8.0 (Confidentiality, Integrity and     Availability impacts). (CVE-2020-2968)

  - Vulnerability in the Core RDBMS (zlib) component of     Oracle Database Server. The supported version that is     affected is 18c. Easily exploitable vulnerability allows     high privileged attacker having Create Session privilege     with network access via Oracle Net to compromise Core     RDBMS (zlib). Successful attacks of this vulnerability     can result in takeover of Core RDBMS (zlib). CVSS 3.1     Base Score 7.2 (Confidentiality, Integrity and     Availability impacts).(CVE-2016-9843)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Oracle WebCenter Sites component of Oracle Fusion Middleware is vulnerable to multiple vulnerabilities :

  - A deserialization vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware     (subcomponent: Advanced UI (Apache Groovy)) due to a lack of isolation of object deserialization code. An     unauthenticated, remote attacker can exploit this, via HTTP, to execute arbitrary code on the target host.
    (CVE-2016-6814)

  - A remote code execution vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Apache Commons FileUpload)) due to an unspecified reason. An     unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Third Party Tools (Apache Batik)) due to an issue with deserialization. An     unauthenticated, remote attacker can exploit this issue, via HTTP, to cause the application to stop     functioning properly. (CVE-2018-8013)

  - A denial of service (DoS) vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion     Middleware (subcomponent: Advanced UI (Spring Framework)) due to an issue handling range requests with     a high number of ranges, wide ranges that overlap, or both. An unauthenticated, remote attacker can     exploit this issue, via HTTP, to cause the application to stop responding. (CVE-2018-15765)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.9.x prior to 11.1.1.9.200414 or 12.2.1.3.x prior to 12.2.1.3.200414 or 12.2.1.4.x prior to 12.2.1.4.200414. It is, therefore, affected by multiple vulnerabilities as noted in the April 2020 Critical Patch Update advisory

  - An unspecified vulnerability in the Analystics Web     General component of Oracle BI Published. An easily     exploitable vulnerability could allow an     unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise     Edition. A successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence     Enterprise Edition. (CVE-2020-2950)

  - The Bouncy Castle Java library before 1.51 does not     validate a point is withing the elliptic curve, which     makes it easier for remote attackers to obtain private     keys via a series of crafted elliptic curve Diffie     Hellman (ECDH) key exchanges, aka an invalid curve     attack. (CVE-2015-7940)

  - Apache Commons FileUpload before 1.3.3 DiskFileItem File     Manipulation Remote Code Execution (CVE-2016-1000031)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities: 

  - A deserialization vulnerability exists in Apache Commons FileUpload library. An unauthenticated, remote attacker     can exploit this, via customized Java serialised object, to execute arbitrary code on the target host.
    (CVE-2016-1000031)

  - An unspecified vulnerability in the Load Testing for Web Apps component of Oracle Application Testing Suite, which     could allow an unauthenticated, remote attacker to read, update, or delete Oracle Application Testing Suite     accessible data and gives an ability to cause a partial denial of service (partial DOS). (CVE-2019-2727)

This update for jakarta-commons-fileupload fixes the following issue :

Security issue fixed :

  - CVE-2016-1000031: Fixed remote execution (bsc#1128963,     bsc#1128829).

This update was imported from the SUSE:SLE-15:Update update project.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - An information disclosure vulnerability exists in OpenSSL     due to the potential for a side-channel timing attack.
    An unauthenticated attacker can exploit this to disclose     potentially sensitive information. (CVE-2018-0734)

  - A denial of service (DoS) vulnerability exists in Apache     HTTP Server 2.4.17 to 2.4.34, due to a design error. An     unauthenticated, remote attacker can exploit this issue     by sending continuous, large SETTINGS frames to cause a     client to occupy a connection, server thread and CPU     time without any connection timeout coming to effect.
    This affects only HTTP/2 connections. A possible     mitigation is to not enable the h2 protocol.
    (CVE-2018-11763).

  - Networking component of Enterprise Manager Base Platform     (Spring Framework) is easily exploited and may allow an     unauthenticated, remote attacker to takeover the     Enterprise Manager Base Platform. (CVE-2018-1258)

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the April 2019 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

 - A flaw exists in FasterXML jackson-databind 2.x before 2.9.8 due to    a failure to block the jboss-common-core class from polymorphic    deserialization. A remote attacker can exploit this, via leveraging    this failure, to cause unspecified impact. (CVE-2018-19362)

 - A vulnerability exists in Apache Commons FileUpload before 1.3.3. If    an application  deserializes data from an untrusted source without    filtering and/or validation, a remote attacker can exploit this to    cause remote code execution. (CVE-2016-1000031)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.x prior to 16.2.15.7 or 17.7.x prior to 17.12.10 or 18.x prior to 18.8.6. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service (DoS) vulnerability exists in     Apache HTTP Server 2.4.17 to 2.4.34, due to a design     error. An unauthenticated, remote attacker can     exploit this issue by sending continuous, large     SETTINGS frames to cause a client to occupy a     connection, server thread and CPU time without any     connection timeout coming to effect. This affects     only HTTP/2 connections. A possible mitigation is to     not enable the h2 protocol. (CVE-2018-11763).

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.10, 15.x prior to 15.2.18.4, 16.x prior to 16.2.17.2, 17.x prior to 17.12.12.0, or 18.x prior to 18.8.8.0. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service vulnerability in the bundled     third-party component OpenSSL library's DSA signature     algorithm that renders it vulnerable to a timing side     channel attack. An attacker could leverage this     vulnerability to recover the private key.
    (CVE-2018-0734)

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution.

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Administration). Supported versions that are affected are 3.0.1 and 3.1.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GlassFish Server executes to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 3.3 (Confidentiality impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Core). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle GlassFish Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data. CVSS v3.0 Base Score 4.3 (Integrity impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GlassFish Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle GlassFish Server accessible data as well as unauthorized read access to a subset of Oracle GlassFish Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GlassFish Server. CVSS v3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3.0.1 and 3.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GlassFish Server. While the vulnerability is in Oracle GlassFish Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GlassFish Server. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

The version of Apache Struts running on the remote host is 2.3.36 or prior. It is, therefore, affected by the following vulnerability:

  - A deserialization vulnerability in Apache Commons     FileUpload which could be leveraged for remote     code execution. (CVE-2016-1000031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Apache Axis2 reports :

The commons-fileupload dependency has been updated to a version that fixes CVE-2016-1000031 (AXIS2-5853).

The version of Apache Struts running on the remote host is 2.5.x prior to 2.5.12. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists when handling     a specially crafted URL in a form field when the     built-in URL validator is used. An unauthenticated,     remote attacker can exploit this to cause the server     process to overload. Note that this issue only affects     version 2.5.x. (CVE-2017-7672)

  - A flaw exists in unspecified Spring AOP functionality     that is used to secure Struts actions. An authenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2017-9787)

  - A deserialization vulnerability in Apache Commons     FileUpload which could be leveraged for remote     code execution. (CVE-2016-1000031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
150613	SUSE SLES11 Security Update : jakarta-commons-fileupload (SUSE-SU-2019:14044-1)	Nessus	SuSE Local Security Checks	critical
145267	Oracle Enterprise Manager Cloud Control (Jan 2021 CPU)	Nessus	Misc.	critical
141564	IBM WebSphere Application Server 8.0.0.x < 8.0.0.15 / 8.5.x < 8.5.5.13 / 9.0.x < 9.0.0.7 RCE (CVE-2016-1000031)	Nessus	Web Servers	critical
138528	Oracle Database Server Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	critical
136091	Oracle WebCenter Sites Multiple Vulnerabilities (July 2019 CPU)	Nessus	Windows	critical
135678	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Misc.	critical
126788	Oracle Application Testing Suite Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Misc.	critical
125212	openSUSE Security Update : jakarta-commons-fileupload (openSUSE-2019-1399)	Nessus	SuSE Local Security Checks	critical
125147	Oracle Enterprise Manager Ops Center (Apr 2019 CPU)	Nessus	Misc.	critical
124237	Oracle WebCenter Portal Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	Misc.	critical
124170	Oracle Primavera Unifier Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	CGI abuses	critical
124169	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	CGI abuses	critical
119274	FreeBSD : payara -- Multiple vulnerabilities (d70c9e18-f340-11e8-be46-0019dbb15b3f)	Nessus	FreeBSD Local Security Checks	critical
118732	Apache Struts <= 2.3.36 FileUpload Deserialization Vulnerability	Nessus	Misc.	critical
102280	FreeBSD : Axis2 -- Security vulnerability on dependency Apache Commons FileUpload (c1265e85-7c95-11e7-93af-005056925db4)	Nessus	FreeBSD Local Security Checks	critical
101548	Apache Struts 2.5.x < 2.5.12 Multiple DoS (S2-047) (S2-049)	Nessus	Misc.	critical

Detections

Analytics

CVE-2016-1000031

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical