The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory. 

  - Vulnerability in the Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c   and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via   multiple protocols to compromise Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite).   Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of Oracle Database - Enterprise Edition Security (Dell BSAFE Micro Edition Suite)   (CVE-2020-5360).

  - Vulnerability in the Workload Manager (Apache Tomcat) component of Oracle Database Server. Supported versions   that are affected are 18c and 19c. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Workload Manager (Apache Tomcat). Successful attacks of this vulnerability can   result in unauthorized access to critical data or complete access to all Workload Manager (Apache Tomcat)   accessible data (CVE-2020-17527).

  - Vulnerability in the Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) component of Oracle Database   Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability   allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Database - Enterprise   Edition (Dell BSAFE Crypto-J). Successful attacks require human interaction from a person other than the attacker.   Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to   all Oracle Database - Enterprise Edition (Dell BSAFE Crypto-J) accessible data (CVE-2019-3740). 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Database Server Multiple Vulnerabilities (Apr 2021 CPU)

high Nessus Plugin ID 148894

Version 1.9

Version 1.8

Version 1.9 Jan 3, 2024, 2:22 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202401031422
Version 1.8 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101