Oracle Business Intelligence Publisher Multiple Vulnerabilities (July 2018 CPU)

Medium Nessus Plugin ID 119940

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.180717 or 11.1.1.9.x prior to 11.1.1.9.180717, similarly, versions 12.2.1.2.x prior to 12.2.1.2.180717 and 12.2.1.3.x prior to 12.2.1.3.180717 are affected as noted in the July 2018 Critical Patch Update advisory. The Oracle Business Intelligence Publisher installed on the remote host is affected by multiple vulnerabilities:

- A vulnerability exists on the Layout Tools, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker can exploit the vulnerability via HTTP access to compromise BI Publisher. A successful attack could result in an unauthorized creation, deletion or modification of critical data on BI Publisher including read data to a subset of information (CVE-2018-2900).

- A vulnerability exists on the Web Server, Oracle BI Publisher component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can easily exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2925).

- A vulnerability exists on the BI Publisher Security, Oracle BI Publisher component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to compromise Oracle BI Publisher. Unauthorized access to critical data hosted in the remote server can be possible after a successful exploit of the vulnerability (CVE-2018-2958).
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the July 2018 Oracle Critical Patch Update advisory.

See Also

http://www.nessus.org/u?d0716163

Plugin Details

Severity: Medium

ID: 119940

File Name: oracle_bi_publisher_jul_2018_cpu.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 2018/12/28

Updated: 2019/01/15

Dependencies: 76708, 53258

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2018-2958

CVSS v2.0

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS v3.0

Base Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Vulnerability Information

CPE: cpe:/a:oracle:fusion_middleware, cpe:/a:oracle:business_intelligence_publisher

Patch Publication Date: 2018/07/17

Vulnerability Publication Date: 2018/07/17

Reference Information

CVE: CVE-2018-2900, CVE-2018-2925, CVE-2018-2958

BID: 104767