Oracle REST Data Services (CSPU May 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318834);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/08");

  script_cve_id(
    "CVE-2026-35266",
    "CVE-2026-35277",
    "CVE-2026-46775",
    "CVE-2026-46829",
    "CVE-2026-46830",
    "CVE-2026-46839",
    "CVE-2026-46840",
    "CVE-2026-46841",
    "CVE-2026-46842",
    "CVE-2026-46843"
  );
  script_xref(name:"IAVA", value:"2026-A-0527");

  script_name(english:"Oracle REST Data Services (CSPU May 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is running a version of Oracle REST Data Services that is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Oracle REST Data Services (ORDS) installed on the remote host is 24.2.0 through 26.1.0. It is,
therefore, affected by multiple vulnerabilities as referenced in the May 2026 Critical Security Patch Update (CSPU)
advisory.

  - Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Easily exploitable vulnerability
    allows an unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. While
    the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope
    change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.
    (CVE-2026-46840)

  - Vulnerability in Oracle REST Data Services (component: Core). Easily exploitable vulnerability allows a low
    privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. While the vulnerability
    is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful
    attacks of this vulnerability can result in takeover of Oracle REST Data Services. (CVE-2026-46775, CVE-2026-46839)

  - Vulnerability in Oracle REST Data Services (component: Core). Easily exploitable vulnerability allows a low
    privileged attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of
    this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all
    Oracle REST Data Services accessible data as well as unauthorized access to critical data or complete access to
    all Oracle REST Data Services accessible data. (CVE-2026-35277)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cspumay2026.html#AppendixORDS");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cspumay2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the May 2026 Oracle Critical Security Patch Update advisory.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-46840");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:rest_data_services");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_rest_data_services_detect_nix.nbin");
  script_require_keys("installed_sw/Oracle REST Data Services");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Oracle REST Data Services', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '24.2.0', 'fixed_version': '26.1.2'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:res);