Oracle Business Intelligence Enterprise Edition (12.2.1.4) (January 2026 CPU)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296369);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id(
    "CVE-2024-57699",
    "CVE-2025-9230",
    "CVE-2025-9232",
    "CVE-2025-31672",
    "CVE-2025-48924"
  );
  script_xref(name:"IAVA", value:"2026-A-0070-S");

  script_name(english:"Oracle Business Intelligence Enterprise Edition (12.2.1.4) (January 2026 CPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Oracle Business Intelligence Enterprise Edition 12.2.1.4 installed on the remote host is affected
by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics 
    (component: Analytics Server (json-smart)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 
    and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via 
    HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this 
    vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete 
    DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-57699)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics 
    (component: Analytics Server (Apache POI)). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 
    and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via 
    multiple protocols to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of 
    this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) 
    of Oracle Business Intelligence Enterprise Edition. (CVE-2025-31672)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics 
    (component: Platform Security (Apache Commons Lang)). Supported versions that are affected are 7.6.0.0.0, 
    8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network 
    access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this 
    vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of 
    Oracle Business Intelligence Enterprise Edition. (CVE-2025-48924)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cpujan2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cpujan2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the January 2026 Oracle Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-57699");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-31672");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:business_intelligence");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_business_intelligence_enterprise_edition_installed.nbin");
  script_require_keys("installed_sw/Oracle Business Intelligence Enterprise Edition");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Oracle Business Intelligence Enterprise Edition');

var constraints = [
  {'min_version': '12.2.1.4', 'fixed_version': '12.2.1.4.251211', 'fixed_display': '12.2.1.4.251211 patch: 38750906'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);