Oracle APEX Sample Applications (Brookstrut) (CVE-2026-21931)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(297229);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/03");

  script_cve_id("CVE-2026-21931");
  script_xref(name:"IAVA", value:"2026-A-0063");

  script_name(english:"Oracle APEX Sample Applications (Brookstrut) (CVE-2026-21931)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host is affected by a vulnerability in the Oracle APEX Sample Applications product of Oracle APEX
(component: Brookstrut Sample App) as referenced in the January 2026 Oracle Critical Patch Update (CPU) advisory.

  - Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample
    App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1. Easily exploitable
    vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle APEX Sample
    Applications. Successful attacks require human interaction from a person other than the attacker and while
    the vulnerability is in Oracle APEX Sample Applications, attacks may significantly impact additional products
    (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or
    delete access to some of Oracle APEX Sample Applications accessible data as well as unauthorized read
    access to a subset of Oracle APEX Sample Applications accessible data. (CVE-2026-21931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpujan2026.html");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpujan2026csaf.json");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the January 2026 Oracle Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-21931");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/30");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_express");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_apex_web_detect.nbin");
  script_require_ports("Services/www", 443);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var port = get_http_port(default:443);

var app_info = vcf::get_app_info(app:'Oracle Application Express (APEX)', port:port, webapp:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'equal' : '23.2.0', 'fixed_display' : '24.2.13 or later' },
  { 'equal' : '23.2.1', 'fixed_version' : '24.2.13 or later' },
  { 'equal' : '24.1.0', 'fixed_version' : '24.2.13 or later' },
  { 'equal' : '23.2.0', 'fixed_display' : '24.2.13 or later' },
  { 'equal' : '24.2.1', 'fixed_version' : '24.2.13 or later' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);