Detections
Analytics
Oracle Business Process Management Suite (Jan 2021 CPU)
critical Nessus Plugin ID 145246
Language:
Synopsis
The remote host is affected by multiple vulnerabilities.Description
The version of Oracle Business Process Management Suite installed on the remote host is affected by the following vulnerabilities as referenced in the January 2021 CPU advisory:- An XML External Entity (XXE) vulnerability exists in the dom4j library which allows DTDs and external entities by default. An unauthenticated, remote attacker can exploit this issue, to compromise the server.
Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. (CVE-2020-10683)
- A deserialization flaw exists in the Oracle BAM (Business Activity Monitoring) product of Oracle Fusion Middleware (component: General (Xstream)) due to the introduction of a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. (CVE-2019-10173)
- A denial of service (DoS) vulnerability exists in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Tomcat)) due to improper validation of the payload length in a WebSocket frame. An unauthenticated, remote attacker can exploit this issue to trigger an infinite loop and cause a hang or frequently repeatable crash of Oracle Managed File Transfer.
(CVE-2020-13935)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patch according to the January 2021 Oracle Critical Patch Update advisory.See Also
Plugin Details
Severity: Critical
ID: 145246
File Name: oracle_bpm_cpu_jan_2021.nasl
Version: 1.5
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 1/22/2021
Updated: 12/5/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-10683
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:business_process_management_suite
Required KB Items: installed_sw/Oracle Business Process Manager
Exploit Ease: No known exploits are available
Patch Publication Date: 1/19/2021
Vulnerability Publication Date: 1/19/2021