According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the following vulnerabilities in its subcomponents:

  - Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when     alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results     are used with no namespace and in same time, its upper package have no or wildcard namespace and similar     to results, same possibility when using url tag which doesn't have value and action set and in same time,     its upper package have no or wildcard namespace. (CVE-2018-11776)

  - The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31,     8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It     is expected that users of the CORS filter will have configured it appropriately for their environment     rather than using it in the default configuration. Therefore, it is expected that most users will not be     impacted by this issue. (CVE-2018-8014)

  - Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an     authorization bypass when using method security. An unauthorized malicious user can gain unauthorized     access to methods that should be restricted. (CVE-2018-1258)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MySQL Enterprise Monitor 3.4.x < 3.4.10 / 4.x < 4.0.7 / 8.x < 8.0.3 Multiple Vulnerabilities (Oct 2018 CPU)

critical Nessus Plugin ID 138901

Version 1.10

Version 1.9

Version 1.10 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 1.9 Feb 2, 2023, 2:12 PM Exploit attributes ("Exploit framework metasploit" set to "True") Plugin Feed: 202302021412