The versions of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5,     21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable vulnerability     allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks require human interaction from a person other than the attacker     and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may     significantly impact additional products (scope change). Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project     Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6     Enterprise Project Portfolio Management accessible data. (CVE-2025-21526)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5,     21.12.1.0-21.12.20.0, 22.12.1.0-22.12.16.0 and 23.12.1.0-23.12.10.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Primavera P6 Enterprise Project Portfolio Management accessible data. (CVE-2025-21528)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web Access). Supported versions that are affected are 20.12.1.0-20.12.21.5,     21.12.1.0-21.12.20.0 and 22.12.1.0. Easily exploitable vulnerability allows low privileged attacker with     network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful     attacks require human interaction from a person other than the attacker and while the vulnerability is in     Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products     (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as     unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible     data. (CVE-2025-21558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Primavera P6 Enterprise Project Portfolio Management (January 2025 CPU)

medium Nessus Plugin ID 214528

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jan 24, 2025, 1:52 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202501241352
Version 1.2 Jan 24, 2025, 8:50 AM CVSSv2 score source (changed from "CVE-2025-21526" to "CVE-2025-21558") Plugin Feed: 202501240850
Version 1.1 Jan 23, 2025, 5:18 PM New Plugin Feed: 202501231718