Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : 

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component: Oracle Flow Builder (Jython)).   Supported versions that are affected are 12.5.0.3, 13.1.0.1, 13.2.0.1 and 13.3.0.1.   Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Oracle Application Testing Suite. Successful attacks    of this vulnerability can result in takeover of Oracle Application Testing Suite.   (CVE-2016-4000)	

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Oracle Flow Builder (Jython).  An unauthenticated, remote attacker with network     access via HTTP to compromise Oracle Application Testing Suite. (CVE-2016-4000)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Load Testing for Web Apps (Apache POI).  An unauthenticated, remote attacker with network     access via HTTP to compromise Oracle Application Testing Suite and cause the process to hang     or frequently repeatable crash (complete DOS). (CVE-2017-12626)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Oracle Flow Builder (Apache POI).  An unauthenticated, remote attacker with network     access via HTTP to compromise Oracle Application Testing Suite and cause the process to hang     or frequently repeatable crash (complete DOS). (CVE-2017-12626)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Load Testing for Web Apps (AntiSamy).  An unauthenticated, remote attacker with network     access via HTTP who is able to obtain human interaction can impact additional products and result in     an unauthorized update, insert, or delete access to some accessible data as well as unauthorized     read access to a subset of accessible data. (CVE-2017-14735)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Oracle Flow Builder (Antisamy).  An unauthenticated, remote attacker with network     access via HTTP who is able to obtain human interaction can impact additional products and result in     an unauthorized update, insert, or delete access to some accessible data as well as unauthorized     read access to a subset of accessible data. (CVE-2017-14735)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Load Testing for Web Apps (Application Development Framework).  An unauthenticated, remote attacker with network     access via HTTP can result in takeover of Oracle Application Testing Suite. (CVE-2019-2904)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Oracle Flow Builder (jQuery).  An unauthenticated, remote attacker with network     access via HTTP who is able to obtain human interaction can impact additional products and result in     an unauthorized update, insert, or delete access to some accessible data as well as unauthorized     read access to a subset of accessible data. (CVE-2019-11358)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Load Testing for Web Apps (Apache POI).  An authenticated, low priviledged remote attacker     with network access to the infrastructure can result in unauthorized access to critical data or    complete access to all Oracle Application Testing Suite accessible data. (CVE-2019-12415)

  - An unspecified vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager     subcomponent Oracle Flow Builder.  An unauthenticated remote attacker     with network access via HTTP can result in unauthorized access to critical data or    complete access to all Oracle Application Testing Suite accessible data. (CVE-2020-2673)

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.15.10, or 17.7.x through 17.12.x prior to 17.12.11.1, or 18.8.x prior to 18.8.13.0. It is, therefore, affected by multiple vulnerabilities:

    - An unspecified flaw exists in how 'default typing' is handled when 'ehcache' is used in the       jackson-databind component of Primavera Unifier. An unauthenticated, remote attacker can exploit this       via the network over HTTP to cause remote code execution. (CVE-2019-14379)

    - An information disclosure vulnerability exists in the jackson-databind component of Primavera Unifier.
      An unauthenticated, remote attacker can exploit this via an externally exposed JSON endpoint if the       service has the mysql-connector-java jar in the classpath, and the attacker can host a crafted MySQL       server accessible by the victim. An attacker can send a crafted JSON message to read arbitrary local       files on the server. (CVE-2019-12086)

    - An information disclosure vulnerability exists in the jackson-databind component of Primavera Unifier.
      An unauthenticated, remote attacker can exploit this via an externally exposed JSON endpoint if the       service has the logback jar in the classpath, which can allow information disclosure. (CVE-2019-14439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 15.x prior to 15.2.18.7, 16.x prior to 16.2.19.1, 17.x prior to 17.12.15.0, or 18.8.x prior to 18.8.14.0. It is, therefore, affected by multiple vulnerabilities:

  - A authorization vulnerability exists in Primavera P6 Enterprise Project Portfolio Management. An unauthenticated     remote attacker can exploit this via HTTP to access controlled information on the network and EPPM.
    (CVE-2019-3020)

  - A authorization vulnerability exists in Primavera P6 Enterprise Project Portfolio Management. An authenticated remote     attacker with low privilages can exploit this via HTTP to access controlled information on the network and EPPM.
    (CVE-2019-2976)

  - Denial of service (DDoS) vulnerability exists in Primavera P6 Enterprise Project Portfolio Management due to Out of     Memory Exceptions while prasing documents. (CVE-2017-12626)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.17, 16.x prior to 16.2.10, 17.x prior to 17.12.5, or 18.x prior to 18.8.7. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary file read vulnerability exists in the FasterXML jackson-databind component, which is version     2.x prior to 2.9.9. This vulnerability is due to missing com.mysql.cj.jdbc.admin.MiniAdmin validation. An     unauthenticated, remote attacker can exploit this by hosting a crafted MySQL server reachable by the     victim and sending a crated JSON message that allows them to read arbitrary files and disclose sensitive     information. (CVE-2019-12086)

  - Denial of service (DoS) vulnerabilities exist in the Apache POI component, which is prior to 3.1.7, due     to a flaw when parsing crafted WMF, EMF, MSG, macros, DOC, PPT, and XLS. An unauthenticated, remote     attacker can exploit this issue, via sending crafted input, to cause the application to stop responding.
    (CVE-2017-12626)

  - A remote code execution vulnerability exists in the FasterXML jackson-databind component, which is prior     to 2.9.0.2, due to a flaw in how default typing is handled when ehcache is used because of     net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands. (CVE-2019-14379)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream release and security fix for CVE-2017-12626

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apache POI installed on the remote host is a version prior to 3.17. It is, therefore, affected by multiple DoS vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
133260	Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Misc.	critical
130070	Oracle Primavera Unifier Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	CGI abuses	critical
130059	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	CGI abuses	critical
130019	Oracle Primavera Gateway Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	CGI abuses	critical
120414	Fedora 28 : apache-poi (2018-4f2c2615b3)	Nessus	Fedora Local Security Checks	high
106717	Apache POI < 3.17 Multiple DoS Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2017-12626

high

Tenable Plugins

critical

critical

critical

critical

high

high