The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Admin Screens and     Grants UI). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability     allows high privileged attacker with network access via HTTP to compromise Oracle Workflow. While the     vulnerability is in Oracle Workflow, attacks may significantly impact additional products (scope change).
    Successful attacks of this vulnerability can result in takeover of Oracle Workflow. (CVE-2024-21071)

  - Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Import     Utility). Supported versions that are affected are 12.2.4-12.2.12. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Production Scheduling.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Production Scheduling accessible data. (CVE-2024-21088)

  - Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Campaign LOV).
    Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks     of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle     Marketing accessible data. (CVE-2024-21079)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle E-Business Suite (April 2024 CPU)

high Nessus Plugin ID 193570

Version 1.1

Version 1.0

Version 1.1 Dec 9, 2024, 9:30 AM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N") CVSSv3 score source (set to "CVE-2024-21076") Plugin Feed: 202412090930
Version 1.0 Apr 19, 2024, 2:11 PM New Plugin Feed: 202404191411