Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329321);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id(
    "CVE-2024-7254",
    "CVE-2025-67721",
    "CVE-2026-2332",
    "CVE-2026-3448",
    "CVE-2026-33870",
    "CVE-2026-33871"
  );
  script_xref(name:"IAVA", value:"2026-A-0743");

  script_name(english:"Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The Oracle GoldenGate for Big Data application on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote
host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate
    (component: Third Party (Eclipse Jetty)). Easily exploitable vulnerability allows unauthenticated attacker
    with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful
    attacks of this vulnerability can result in unauthorized access to critical data or complete access to all
    Oracle GoldenGate Big Data and Application Adapters accessible data as well as unauthorized update, insert
    or delete access to some of Oracle GoldenGate Big Data and Application Adapters accessible data.
    (CVE-2026-2332)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate
    (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with
    network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful
    attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable
    crash (complete DOS) of Oracle GoldenGate Big Data and Application Adapters. (CVE-2026-33871)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate
    (component: Third Party (Netty)). Easily exploitable vulnerability allows unauthenticated attacker with
    network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters. Successful
    attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle
    GoldenGate Big Data and Application Adapters accessible data. (CVE-2026-33870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.oracle.com/docs/tech/security-alerts/cpujul2026csaf.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8bb270a9");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpujul2026.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Oracle GoldenGate for Big Data / GoldenGate for Distributed Applications and Analytics version
23.26.3.0.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-2332");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-33871");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:goldengate_application_adapters");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_goldengate_for_big_data_installed.nbin");
  script_require_keys("installed_sw/Oracle GoldenGate for Big Data");

  exit(0);
}

include('vcf.inc');

var app_name = 'Oracle GoldenGate for Big Data';
var app_info = vcf::get_app_info(app:app_name);

var constraints = [
  { 'min_version':'23.0.0.0.0', 'fixed_version':'23.26.3.0.0', 'fixed_display':'23.26.3.0.0 (39751351)' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);