Oracle Business Intelligence Enterprise Edition (OAS 7.6) (April 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(309965);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/27");

  script_cve_id(
    "CVE-2021-28168",
    "CVE-2023-52428",
    "CVE-2025-33042",
    "CVE-2025-48734",
    "CVE-2025-68161",
    "CVE-2026-27727",
    "CVE-2026-27830"
  );
  script_xref(name:"IAVA", value:"2026-A-0382");

  script_name(english:"Oracle Business Intelligence Enterprise Edition (OAS 7.6) (April 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0.0 installed on the remote host is affected
by multiple vulnerabilities as referenced in the April 2026 CPU advisory.

  - mchange-commons-java, a library that provides Java utilities, includes code that mirrors early
    implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by
    which code can be downloaded and invoked within a running application. If an attacker can provoke an
    application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke
    the download and execution of malicious code. Implementations of this functionality within the JDK were
    disabled by default behind a System property that defaults to `false`,
    `com.sun.jndi.ldap.object.trustURLCodebase`. However, since mchange-commons-java includes an independent
    implementation of JNDI derefencing, libraries (such as c3p0) that resolve references via that
    implementation could be provoked to download and execute malicious code even after the JDK was hardened.
    Mirroring the JDK patch, mchange-commons-java's JNDI functionality is gated by configuration parameters
    that default to restrictive values starting in version 0.4.0. No known workarounds are available. Versions
    prior to 0.4.0 should be avoided on application CLASSPATHs. (CVE-2026-27727)

  - Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure
    vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system
    temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all
    other users locally on the system. As such, if the contents written is security sensitive, it can be
    disclosed to other local users. (CVE-2021-28168)

  - In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource
    consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter
    (PBKDF2) component. (CVE-2023-52428)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpuapr2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpuapr2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the April 2026 Oracle Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-28168");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-27727");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-27830");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:business_intelligence");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_analytics_server_installed.nbin");
  script_require_keys("installed_sw/Oracle Analytics Server");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Oracle Analytics Server');

# Oracle delayed the April 2026 CPU patch for OAS 7.6 (ETA 04/30).
# max_version is set to 7.6.0.0.251219 (Jan 2026 CPU fix) — the last known patched version.
# Update with fixed_version once the patch is released.
var constraints = [
  {'min_version': '7.6.0.0.0', 'max_version': '7.6.0.0.251219',
   'fixed_display': 'Apply the April 2026 CPU patch when available (delayed, ETA 04/30)',
   'require_paranoia': TRUE}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_NOTE);