MySQL Enterprise Monitor < 2.3.14 Apache Struts Multiple Vulnerabilities

critical Nessus Plugin ID 83292

Language:

Synopsis

A web application running on the remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version, the MySQL Enterprise Monitor running on the remote host is affected by the multiple vulnerabilities in the bundled version of Apache Struts :

- Input validation errors exist that allows the execution of arbitrary Object-Graph Navigation Language (OGNL) expressions via specially crafted parameters to the DefaultActionMapper. (CVE-2013-2251)

- Multiple unspecified vulnerabilities exist related to dynamic method invocation being enabled by default.
(CVE-2013-4316)

Solution

Upgrade to MySQL Enterprise Monitor 2.3.14 or later.

Plugin Details

Severity: Critical

ID: 83292

File Name: mysql_enterprise_monitor_2_3_14.nasl

Version: 1.11

Type: remote

Family: CGI abuses

Published: 5/8/2015

Updated: 4/25/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2013-4316

Vulnerability Information

CPE: cpe:/a:mysql:enterprise_monitor, cpe:/a:apache:struts

Required KB Items: installed_sw/MySQL Enterprise Monitor

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/9/2013

Vulnerability Publication Date: 7/16/2013

CISA Known Exploited Vulnerability Due Dates: 4/15/2022

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution)

Elliot (Apache-Struts DefaultActionMapper < 2.3.15.1 RCE Linux)

Reference Information

CVE: CVE-2013-2251, CVE-2013-4316

BID: 61189, 62587

Detections

Analytics