The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory:  

  - Vulnerability in the Runtime Engine (Application Development Framework). An unauthenticated, remote     attacker with network access via HTTP can exploit this issue to compromise the Oracle Business Process     Management Suite. Successful attacks require human interaction from a person other than the attacker and     while the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact     additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Business Process Management Suite accessible data as well as unauthorized     read access to a subset of Oracle Business Process Management Suite accessible data. (CVE-2019-2904)

  - Vulnerability in the Runtime Engine (Apache Ant). An authenticated, local attacker can exploit this issue     to compromise the Oracle Business Process Management Suite. Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all Oracle Business     Process Management Suite accessible data as well as unauthorized access to critical data or complete     access to all Oracle Business Process Management Suite accessible data. (CVE-2020-1945)

  - Vulnerability in the Runtime Engine (jQuery). An unauthenticated, remote attacker with network access via     HTTP can exploit this issue to compromise Oracle Business Process Management Suite. Successful attacks     require human interaction from a person other than the attacker and while the vulnerability is in Oracle     Business Process Management Suite, attacks may significantly impact additional products. Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Business Process Management Suite accessible data as well as unauthorized read access to a subset of     Oracle Business Process Management Suite accessible data. (CVE-2019-11358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

Detections

Analytics

Oracle Business Process Management Suite (Oct 2020 CPU)

critical Nessus Plugin ID 142210

Version 1.6

Version 1.5

Version 1.6 Feb 12, 2024, 2:52 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202402121452
Version 1.5 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653