The version of Primavera Gateway installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - Vulnerability in the Oracle Retail Store Inventory Management product of Oracle Retail Applications     (component: SIM Integration (JDBC)). Supported versions that are affected are 14.1, 15.0 and 16.0.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to     compromise Oracle Retail Store Inventory Management. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Oracle Retail Store Inventory Management,     attacks may significantly impact additional products. Successful attacks of this vulnerability can result     in takeover of Oracle Retail Store Inventory Management. (CVE-2021-2351)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: File     Management (Apache Commons Compress)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12     and 20.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Unifier. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. (CVE-2021-36090)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component:
    Platform, UI (Lodash)). Supported versions that are affected are 17.7-17.12, 18.8, 19.12 and 20.12. Easily     exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise     Primavera Unifier. (CVE-2021-23337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Primavera Gateway (Oct 2021 CPU)

high Nessus Plugin ID 154297

Version 1.8

Version 1.7

Version 1.8 Oct 24, 2023, 4:27 PM IAVM reference Plugin Feed: 202310241627
Version 1.7 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046