Detections
Analytics
Oracle Application Testing Suite (October 2024 CPU)
medium Nessus Plugin ID 209387
Synopsis
The remote host is affected by multiple vulnerabilitiesDescription
The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.- Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
Load Testing for Web Apps (Apache Commons Compress)). The supported version that is affected is 13.3.0.1.
Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Application Testing Suite. (CVE-2023-42503, CVE-2024-26308, CVE-2024-25710)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate patch according to the October 2024 Oracle Critical Patch Update advisory.See Also
https://www.oracle.com/docs/tech/security-alerts/cpuoct2024csaf.json
Plugin Details
Severity: Medium
ID: 209387
File Name: oracle_oats_cpu_oct_2024.nasl
Version: 1.1
Type: local
Agent: windows, macosx, unix
Family: Misc.
Published: 10/21/2024
Updated: 10/21/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2024-26308
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:oracle:application_testing_suite
Required KB Items: installed_sw/Oracle Application Testing Suite
Exploit Ease: No known exploits are available
Patch Publication Date: 10/15/2024
Vulnerability Publication Date: 10/15/2024