Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - axis: Hard coded domain name in example web service named StockQuoteService.jws leading to remote     code execution. (CVE-2019-0227)

  - Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the     default servlet/services. (CVE-2018-8032)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - axis: Hard coded domain name in example web service named StockQuoteService.jws leading to remote     code execution. (CVE-2019-0227)

  - Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the     default servlet/services. (CVE-2018-8032)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.1.7 FP8, 11.2.4 FP3, or 12.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7123154, including the following:

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the   allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using   Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which   addresses this issue. (CVE-2023-39410)

  - In order to decrypt SM2 encrypted data an application is expected to call the API function   EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the   'out' parameter can be NULL and, on exit, the 'outlen' parameter is populated with the buffer size required   to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call   EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the 'out' parameter. A bug in the   implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the   plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by   the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a   second time with a buffer that is too small. A malicious attacker who is able present SM2 content for   decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of   62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour   or causing the application to crash. The location of the buffer is application dependent but is typically   heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). (CVE-2021-3711)

  - SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
  Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using   SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend   upgrading to version 2.0 and beyond. (CVE-2022-1471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2821 advisory.

  - Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the     default servlet/services. (CVE-2018-8032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Unifier installation running on the remote web server is 16.1.x or 16.2.x prior to 16.2.16.0, or 17.7.x through 17.12.x prior to 17.12.11.2, or 18.8.x prior to 18.8.15, or 19.12.x prior to 19.12.0.1. It is, therefore, affected by multiple vulnerabilities:

  - A Polymorphic Typing issue was discovered in FasterXML     jackson-databind before 2.9.10 used in Primavera Unifier.
    (CVE-2019-14540)

  - A memory exhaustion flaw exists in Apache Tika's RecursiveParserWrapper     versions 1.7 - 1.21 used in Primavera Unifier. (CVE-2019-10088)

  - A Server Side Request Forgery (SSRF) vulnerability affected the     Apache Axis 1.4 distribution that was last released in 2006. Security     and bug commits commits continue in the projects Axis 1.x Subversion     repository, legacy users are encouraged to build from source. The     successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is     not vulnerable to this issue. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera Gateway installation running on the remote web server is 15.x prior to 15.2.18, 16.x prior to 16.2.11, 17.x prior to 17.12.6, or 18.x prior to 18.8.8.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - Two Polymorphic Typing issues present in FasterXML jackson-databind related to     com.zaxxer.hikari.HikariDataSource which can be exploited by remote, unauthenticated attackers.
    (CVE-2019-16335, CVE-2019-14540)

  - A man-in-the-middle vulnerability caused by the getCN function in Apache Axis not properly verifying that     the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of     the X.509 certificate. An unauthenticated, remote attacker can exploit this to spoof SSL servers via a     certificate with a subject that specifies a common name in a field that is not a CN field. (CVE-2014-3596)

  - A Server Side Request Forgery (SSRF) vulnerability in Apache Axis that can be exploited by an     unauthenticated, remote attacker. (CVE-2019-0227)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for axis fixes the following security issue :

  - CVE-2018-8032: Prevent cross-site scripting (XSS) attack     in the default servlet/services (bsc#1103658).

This update was imported from the SUSE:SLE-12:Update update project.

Fixes CVE-2018-8032, an XSS attack in axis-based services.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199650	RHEL 5 : axis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199604	RHEL 6 : axis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
193868	IBM Cognos Analytics 11.1.1 < 11.1.7 FP8 / 11.2.x < 11.2.4 FP3 / 12.0.x < 12.0.2 (7123154)	Nessus	CGI abuses	critical
155604	Debian DLA-2821-1 : axis - LTS security update	Nessus	Debian Local Security Checks	medium
133359	Oracle Primavera Unifier Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical
132936	Oracle Primavera Gateway Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	CGI abuses	critical
123338	openSUSE Security Update : axis (openSUSE-2019-792)	Nessus	SuSE Local Security Checks	medium
118195	openSUSE Security Update : axis (openSUSE-2018-1188)	Nessus	SuSE Local Security Checks	medium
112100	Fedora 27 : axis (2018-8a85ed2f10)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-8032

medium

Tenable Plugins

high

high

critical

medium

critical

critical

medium

medium

medium