The 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 versions of HTTP Server installed on the remote host are affected by a vulnerability as referenced in the April 2021 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server Proxy Plug-In product of Oracle Fusion Middleware (component: SSL Module   (Dell BSAFE Micro Edition Suite)). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0.
  Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle   WebLogic Server Proxy Plug-In. Successful attacks of this vulnerability can result in unauthorized ability to cause   a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server Proxy Plug-In. (CVE-2020-5360)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported   versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows   unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks require   human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in   unauthorized update, insert or delete access to some of Oracle HTTP Server accessible data as well as unauthorized   read access to a subset of Oracle HTTP Server accessible data. (CVE-2021-2315)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle HTTP Server (Apr 2021 CPU)

high Nessus Plugin ID 148976

Version 1.8