dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

The version of Oracle JDeveloper installed on the remote host is prior to 12.2.1.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory:

  - Vulnerability in the Essbase product of Oracle Essbase (component: Infrastructure (Apache Commons Compress)). The     supported version that is affected is 21.2. Easily exploitable vulnerability allows low privileged attacker with     access to the physical communication segment attached to the hardware where the Essbase executes to compromise     Essbase. Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Essbase accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of Essbase. (CVE-2019-12402)

  - Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: OAM (Apache POI)).     The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle JDeveloper and ADF executes to compromise Oracle JDeveloper     and ADF. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Oracle JDeveloper and ADF accessible data. (CVE-2019-12415)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application     Service Level Mgmt (dom4j)). The supported version that is affected is 13.4.0.0. Easily exploitable vulnerability      allows unauthenticated attacker with network access via HTTP to compromise Enterprise Manager Base Platform.     Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base Platform.     (CVE-2020-10683)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The 13.4.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the StorageTek Tape Analytics SW Tool product of Oracle Systems (component: Software     (dom4j)). The supported version that is affected is 2.3. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise StorageTek Tape Analytics SW Tool.
    Successful attacks of this vulnerability can result in takeover of StorageTek Tape Analytics SW Tool.     (CVE-2020-10683)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Application Service Level Mgmt (OpenCV)). The supported version that is affected is 13.4.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than     the attacker. Successful attacks of this vulnerability can result in takeover of Enterprise Manager Base     Platform. (CVE-2019-5064)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Discovery Framework (OpenSSL)). The supported version that is affected is 13.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Enterprise Manager Base Platform. (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the January 2021 Critical Patch Update (CPU). It is, therefore, affected by the following vulnerabilities :

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet     Services (dom4j)). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.
    Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. (CVE-2020-10683)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security     Framework (Apache Commons BeanUtils)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle WebCenter Portal accessible data as well as unauthorized     read access to a subset of Oracle WebCenter Portal accessible data and unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle WebCenter Portal. (CVE-2019-10086)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the January 2021 CPU advisory:

  - An XML External Entity (XXE) vulnerability exists in the dom4j library which allows DTDs and external     entities by default. An unauthenticated, remote attacker can exploit this issue, to compromise the server.
    Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management     Suite. (CVE-2020-10683)

  - A deserialization flaw exists in the Oracle BAM (Business Activity Monitoring) product of Oracle     Fusion Middleware (component: General (Xstream)) due to the introduction of a regression for a previous     deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker     to run arbitrary shell commands when unmarshalling XML or any supported format. (CVE-2019-10173)

  - A denial of service (DoS) vulnerability exists in the Oracle Managed File Transfer product of Oracle     Fusion Middleware (component: MFT Runtime Server (Apache Tomcat)) due to improper validation of the     payload length in a WebSocket frame. An unauthenticated, remote attacker can exploit this issue to     trigger an infinite loop and cause a hang or frequently repeatable crash of Oracle Managed File Transfer.
    (CVE-2020-13935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The 13.3.0.1 versions of Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (dom4j)). The supported version that is affected is 13.3.0.1. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle     Application Testing Suite. (CVE-2020-10683)

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (jQuery)). The supported version that is affected is 13.3.0.1. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Application Testing Suite. Successful attacks require human interaction from a person other than     the attacker and while the vulnerability is in Oracle Application Testing Suite, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Application Testing Suite accessible data as well as     unauthorized read access to a subset of Oracle Application Testing Suite accessible data. (CVE-2020-11022)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the October 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including the following:

  - dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might     enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the     safe, non-default behavior in any application that uses dom4j. (CVE-2020-10683)

  - A vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching, CacheStore,     Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle     Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. (CVE-2020-2555)

  - xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the     security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands     when unmarshalling XML or any supported format. e.g. JSON. (CVE-2019-10173)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the cke_protected     syntax). (CVE-2020-9281)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4575-1 advisory.

    It was discovered that dom4j incorrectly handled reading XML data. A remote attacker could exploit this     with a crafted XML file to expose sensitive data or possibly execute arbitrary code. (CVE-2020-10683)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - dom4j before 2.0.3 and 2.1.x before 2.1.3 allows     external DTDs and External Entities by default, which     might enable XXE attacks. However, there is popular     external documentation from OWASP showing how to enable     the safe, non-default behavior in any application that     uses dom4j.(CVE-2020-10683)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3637 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.9 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.8, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.9 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

     wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is     received causing Denial of Service (CVE-2020-14307)

    * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service     (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3639 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.9 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.8, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.9 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

     wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is     received causing Denial of Service (CVE-2020-14307)

    * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service     (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3638 advisory.

    This release of Red Hat JBoss Enterprise Application Platform 7.2.9 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.2.8, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.2.9 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)

    * jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)

    * jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jsf-impl: Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of     CVE-2018-14371 (CVE-2020-6950)

    * resteasy-jaxrs: resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class     (CVE-2020-1695)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

     wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is     received causing Denial of Service (CVE-2020-14307)

    * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service     (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3463 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3461 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3462 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API (CVE-2020-10718)

    * dom4j: XML External Entity vulnerability in default SAX parser (CVE-2020-10683)

    * wildfly-elytron: session fixation when using FORM authentication (CVE-2020-10714)

    * wildfly-undertow: Undertow: Incomplete fix for CVE-2017-2666 due to permitting invalid characters in     HTTP requests (CVE-2020-10687)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10673)

    * hibernate-core: hibernate: SQL injection issue in Hibernate ORM (CVE-2019-14900)

    * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740)

    * jackson-databind: mishandles the interaction between serialization gadgets and typing which could result     in remote command execution (CVE-2020-10672)

    * undertow: EAP: field-name is not parsed in accordance to RFC7230 (CVE-2020-1710)

    * hibernate-validator: Improper input validation in the interpolation of constraint error messages     (CVE-2020-10693)

    * wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain     (CVE-2020-1748)

    * wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, see the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 16.1.x prior to 16.2.20.1, 17.1.x prior to 17.12.17.1, 18.1.x prior to 18.8.19, or 19.12.x prior to 19.12.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory, including the following:

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access (dom4j)). Supported versions that are affected are     16.1.0.0-16.2.20.1, 17.1.0.0-17.12.17.1, 18.1.0.0-18.8.19 and 19.12.0-19.12.6. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera P6     Enterprise Project Portfolio Management. Successful attacks of this vulnerability can result in takeover     of Primavera P6 Enterprise Project Portfolio Management. (CVE-2020-10683)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access (kafka client)). Supported versions that are affected are     19.12.0-19.12.6. Easily exploitable vulnerability allows low privileged attacker with network access via     HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks of this     vulnerability can result in takeover of Primavera P6 Enterprise Project Portfolio Management.
    (CVE-2018-17196)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 17.1.0.0-17.12.17.1,     18.1.0.0-18.8.19 and 19.12.0-19.12.5. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6     Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete     access to some of Primavera P6 Enterprise Project Portfolio Management accessible data.
    (CVE-2020-14706)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the dom4j package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - dom4j before 2.1.3 allows external DTDs and External     Entities by default, which might enable XXE attacks.
    However, there is popular external documentation from     OWASP showing how to enable the safe, non-default     behavior in any application that uses     dom4j.(CVE-2020-10683)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dom4j fixes the following issues :

  - CVE-2020-10683: Fixed an XML External Entity     vulnerability in default SAX parser (bsc#1169760).

This update was imported from the SUSE:SLE-15:Update update project.

A flaw was found in dom4j library. By using the default SaxReader() provided by Dom4J, external DTDs and External Entities are allowed, resulting in a possible XXE.

For Debian 8 'Jessie', this problem has been fixed in version 1.6.1+dfsg.3-2+deb8u2.

We recommend that you upgrade your dom4j packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
152033	Oracle JDeveloper XXE (July 2021 CPU)	Nessus	Misc.	critical
151903	Oracle Enterprise Manager Cloud Control (Jul 2021 CPU)	Nessus	Misc.	critical
146048	Oracle WebCenter Portal Multiple Vulnerabilities (Jan 2021 CPU)	Nessus	Misc.	critical
145246	Oracle Business Process Management Suite (Jan 2021 CPU)	Nessus	Misc.	critical
145224	Oracle Application Testing Suite (Jan 2021 CPU)	Nessus	Misc.	critical
142223	Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2020 CPU)	Nessus	Misc.	critical
141450	Ubuntu 16.04 LTS : dom4j vulnerability (USN-4575-1)	Nessus	Ubuntu Local Security Checks	critical
140869	EulerOS 2.0 SP3 : dom4j (EulerOS-SA-2020-2102)	Nessus	Huawei Local Security Checks	critical
140397	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 6 (RHSA-2020:3637)	Nessus	Red Hat Local Security Checks	critical
140392	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 8 (RHSA-2020:3639)	Nessus	Red Hat Local Security Checks	critical
140390	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.2.9 on RHEL 7 (RHSA-2020:3638)	Nessus	Red Hat Local Security Checks	critical
139619	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3463)	Nessus	Red Hat Local Security Checks	critical
139618	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3461)	Nessus	Red Hat Local Security Checks	critical
139616	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.2 (RHSA-2020:3462)	Nessus	Red Hat Local Security Checks	critical
139129	EulerOS 2.0 SP8 : dom4j (EulerOS-SA-2020-1799)	Nessus	Huawei Local Security Checks	critical
138511	Oracle Primavera P6 Enterprise Project Portfolio Management Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	CGI abuses	critical
137519	EulerOS 2.0 SP2 : dom4j (EulerOS-SA-2020-1677)	Nessus	Huawei Local Security Checks	critical
137014	EulerOS 2.0 SP5 : dom4j (EulerOS-SA-2020-1596)	Nessus	Huawei Local Security Checks	critical
136960	openSUSE Security Update : dom4j (openSUSE-2020-719)	Nessus	SuSE Local Security Checks	critical
136201	Debian DLA-2191-1 : dom4j security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-10683

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical