Vulnerabilities > CVE-2019-13990 - XXE vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(135584);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/06");

  script_cve_id("CVE-2019-13990", "CVE-2019-16943", "CVE-2019-5427");
  script_xref(name:"IAVA", value:"2020-A-0140");

  script_name(english:"Oracle Primavera Unifier (Apr 2020 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by
multiple vulnerabilities as referenced in the CPUApr2020 advisory.

  - initDocumentParser in
    xml/XMLSchedulingDataProcessor.java in Terracotta Quartz
    Scheduler through 2.3.0 allows XXE attacks via a job
    description. (CVE-2019-13990)

  - A Polymorphic Typing issue was discovered in FasterXML
    jackson-databind 2.0.0 through 2.9.10. When Default
    Typing is enabled (either globally or for a specific
    property) for an externally exposed JSON endpoint and
    the service has the p6spy (3.8.6) jar in the classpath,
    and an attacker can find an RMI service endpoint to
    access, it is possible to make the service execute a
    malicious payload. This issue exists because of
    com.p6spy.engine.spy.P6DataSource mishandling.
    (CVE-2019-16943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/a/tech/docs/cpuapr2020cvrf.xml");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuapr2020.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the April 2020 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-16943");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/04/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:oracle:primavera_unifier");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_primavera_unifier.nbin");
  script_require_keys("installed_sw/Oracle Primavera Unifier", "www/weblogic");
  script_require_ports("Services/www", 8002);

  exit(0);
}


include('http.inc');
include('vcf.inc');

get_install_count(app_name:'Oracle Primavera Unifier', exit_if_zero:TRUE);

port = get_http_port(default:8002);
get_kb_item_or_exit('www/weblogic/' + port + '/installed');

app_info = vcf::get_app_info(app:'Oracle Primavera Unifier', port:port);

vcf::check_granularity(app_info:app_info, sig_segments:3);

constraints = [
  { 'min_version' : '16.1', 'fixed_version' : '16.2.16.1' },
  { 'min_version' : '17.7', 'fixed_version' : '17.12.11.3' },
  { 'min_version' : '18.8', 'fixed_version' : '18.8.16' },
  { 'min_version' : '19.12', 'fixed_version' : '19.12.4' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);