================================================================================ VULNERABILITY SCAN REPORT — OPENVAS / GVM 22.8 ================================================================================ Report ID: rpt-2026-0409-a7c3e1 Scan Profile: Full and Fast Scan Start: 2026-04-07 02:00:00 UTC Scan End: 2026-04-07 04:37:22 UTC Scanner: OpenVAS 22.8.1 (Feed: 2026-04-06) Targets: 192.168.10.0/24 (5 hosts discovered) Total Findings: 25 ================================================================================ HOST 1: 192.168.10.10 (web-prod-01) OS Detected: Ubuntu 22.04 LTS Open Ports: 22/tcp, 80/tcp, 443/tcp, 8080/tcp ================================================================================ [1] CRITICAL — CVE-2021-44228 (Log4Shell) CVSS v3.1: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.117834 Port: 8080/tcp Software: Apache Log4j 2.14.1 (bundled in Apache Tomcat 9.0.54) Description: Remote code execution via crafted JNDI lookup in log messages. Attacker can achieve full system compromise without authentication. Fix: Upgrade Log4j to 2.17.1+ or remove JndiLookup class from classpath. References: https://nvd.nist.gov/vuln/detail/CVE-2021-44228 https://logging.apache.org/log4j/2.x/security.html Exploit: Public exploit available. Actively exploited in the wild. Listed in CISA KEV catalog. [2] HIGH — CVE-2023-48795 (Terrapin Attack) CVSS v3.1: 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118201 Port: 22/tcp Software: OpenSSH 8.9p1 Description: SSH channel integrity vulnerability allowing prefix truncation attacks. Enables downgrade of connection security. Fix: Upgrade OpenSSH to 9.6p1+ or disable affected ciphers. References: https://nvd.nist.gov/vuln/detail/CVE-2023-48795 [3] HIGH — CVE-2024-6387 (regreSSHion) CVSS v3.1: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118455 Port: 22/tcp Software: OpenSSH 8.9p1 Description: Race condition in sshd signal handler allows unauthenticated remote code execution on glibc-based Linux systems. Fix: Upgrade OpenSSH to 9.8p1+. References: https://nvd.nist.gov/vuln/detail/CVE-2024-6387 Exploit: PoC available. Exploitation is non-trivial but demonstrated. [4] MEDIUM — Missing HTTP Security Headers CVSS v3.1: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.112081 Port: 443/tcp Software: nginx 1.24.0 Description: The following security headers are missing from HTTPS responses: - Strict-Transport-Security (HSTS) - X-Content-Type-Options - Content-Security-Policy - Permissions-Policy Fix: Configure appropriate security headers in the web server. [5] MEDIUM — TLS Certificate Using SHA-1 Signature CVSS v3.1: 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.105880 Port: 443/tcp Description: The server TLS certificate is signed using SHA-1, which is considered cryptographically weak. Fix: Reissue the certificate with SHA-256 or stronger signature. [6] LOW — Server Banner Disclosure CVSS v3.1: 0.0 (Informational) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.100051 Port: 80/tcp, 443/tcp Software: nginx 1.24.0 Description: The web server discloses its software version in HTTP headers (Server: nginx/1.24.0). This information aids attacker reconnaissance. Fix: Set "server_tokens off;" in nginx configuration. ================================================================================ HOST 2: 192.168.10.20 (db-prod-01) OS Detected: CentOS Stream 9 Open Ports: 22/tcp, 3306/tcp, 9100/tcp ================================================================================ [7] CRITICAL — CVE-2017-0144 (EternalBlue / MS17-010) CVSS v3.1: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Note: Originally CVSS v2 scored 9.3; v3.1 base = 8.1 but treated as Critical due to widespread weaponization. Plugin ID: OID:1.3.6.1.4.1.25623.1.0.108385 Port: 445/tcp (SMBv1 — should not be open on a database server) Software: Samba 4.16.2 (compiled with SMBv1 support) Description: SMBv1 remote code execution vulnerability. While the original CVE targets Windows, this Samba build has SMBv1 enabled and is vulnerable to related SMBv1 protocol attacks. Fix: Disable SMBv1 entirely. Upgrade Samba to 4.19+. Close port 445 if SMB is not required. Exploit: Multiple public exploits. Used by WannaCry, NotPetya, and numerous ransomware campaigns. In CISA KEV catalog. [8] HIGH — CVE-2023-22515 (Default/Weak Credentials — MySQL) CVSS v3.1: 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.117220 Port: 3306/tcp Software: MySQL 8.0.35 Description: MySQL root account is accessible with default credentials (root / root). The database is bound to 0.0.0.0 and reachable from the entire subnet. Fix: Change the root password immediately. Restrict bind-address to 127.0.0.1 or specific application IPs. Implement network ACLs. [9] HIGH — CVE-2024-20961 CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118390 Port: 3306/tcp Software: MySQL 8.0.35 Description: Denial of service vulnerability in MySQL Server optimizer component. Unauthenticated attacker can cause hang or crash. Fix: Upgrade MySQL to 8.0.36+ or 8.3.0+. [10] MEDIUM — CVE-2023-5678 (OpenSSL Excessive Time Checking DH Keys) CVSS v3.1: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118102 Port: 3306/tcp Software: OpenSSL 3.0.10 Description: Processing DH keys or parameters with excessively long values can cause server slowdown (DoS potential). Fix: Upgrade OpenSSL to 3.0.13+ or 3.1.5+. [11] LOW — ICMP Timestamp Response CVSS v3.1: 0.0 (Informational) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.100024 Description: Host responds to ICMP timestamp requests, potentially allowing an attacker to estimate the system clock. Fix: Block ICMP timestamp requests at the host firewall. ================================================================================ HOST 3: 192.168.10.30 (app-staging-01) OS Detected: Debian 12 (Bookworm) Open Ports: 22/tcp, 80/tcp, 443/tcp, 5000/tcp, 6379/tcp ================================================================================ [12] HIGH — CVE-2024-31449 (Redis Lua Sandbox Escape) CVSS v3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118511 Port: 6379/tcp Software: Redis 7.0.11 Description: Authenticated users can escape the Lua sandbox and execute arbitrary code on the Redis server. Fix: Upgrade Redis to 7.0.15+ or 7.2.4+. [13] HIGH — Redis Unauthenticated Access CVSS v3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.108833 Port: 6379/tcp Software: Redis 7.0.11 Description: Redis is accessible without authentication. Any host on the network can read/write data and execute CONFIG commands. Fix: Enable requirepass in redis.conf. Bind to 127.0.0.1 or use network ACLs. Enable TLS for in-transit encryption. [14] MEDIUM — CVE-2024-28849 (follow-redirects SSRF) CVSS v3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118440 Port: 5000/tcp Software: Node.js application using follow-redirects 1.15.4 Description: Authorization header leak when following cross-origin redirects. Fix: Upgrade follow-redirects to 1.15.6+. [15] MEDIUM — TLS 1.0 and 1.1 Enabled CVSS v3.1: 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.105042 Port: 443/tcp Software: nginx 1.24.0 Description: Server accepts TLS 1.0 and TLS 1.1 connections, which are deprecated and have known cryptographic weaknesses. Fix: Disable TLS 1.0 and 1.1. Only allow TLS 1.2 and 1.3. In nginx: ssl_protocols TLSv1.2 TLSv1.3; [16] LOW — Directory Listing Enabled CVSS v3.1: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.100050 Port: 80/tcp Description: Directory listing is enabled on /static/ and /uploads/, revealing file names and directory structure. Fix: Disable autoindex in nginx configuration for these paths. ================================================================================ HOST 4: 192.168.10.40 (ci-runner-02) OS Detected: Ubuntu 20.04 LTS (EOL April 2025 — PAST END OF LIFE) Open Ports: 22/tcp, 8080/tcp, 9090/tcp, 50000/tcp ================================================================================ [17] CRITICAL — CVE-2024-23897 (Jenkins Arbitrary File Read) CVSS v3.1: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118372 Port: 8080/tcp Software: Jenkins 2.426.2 LTS Description: Unauthenticated arbitrary file read via CLI argument parsing. Can lead to remote code execution by reading SSH keys, credentials, or secrets from the filesystem. Fix: Upgrade Jenkins to 2.442+ or LTS 2.426.3+. Disable CLI access: set -Dhudson.cli.CLICommand.disabled=true Exploit: Public exploit available. Actively exploited in the wild. Listed in CISA KEV catalog. [18] HIGH — End of Life Operating System CVSS v3.1: N/A (Policy violation) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.103674 Software: Ubuntu 20.04 LTS (Standard support ended April 2025) Description: The operating system has reached end of standard support. No further security updates will be provided unless ESM (Extended Security Maintenance) is purchased. Fix: Upgrade to Ubuntu 22.04 LTS or 24.04 LTS. [19] MEDIUM — CVE-2024-21626 (runc Container Escape — Leaky Vessels) CVSS v3.1: 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118410 Software: Docker 24.0.5 / runc 1.1.9 Description: Container escape via /proc/self/fd race condition. Malicious container image can break out to host. Fix: Upgrade Docker to 25.0.1+ (includes runc 1.1.12). Exploit: PoC available. High impact in CI/CD environments. [20] MEDIUM — Jenkins CSRF Protection Disabled CVSS v3.1: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.113005 Port: 8080/tcp Software: Jenkins 2.426.2 LTS Description: CSRF protection is disabled in Jenkins global security configuration, allowing cross-site request forgery attacks. Fix: Enable CSRF protection in Manage Jenkins > Security. [21] LOW — SSH Weak MAC Algorithms CVSS v3.1: 2.6 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.108077 Port: 22/tcp Software: OpenSSH 8.9p1 Description: SSH server accepts weak MAC algorithms: hmac-sha1, hmac-md5. Fix: Remove weak MAC algorithms from sshd_config. Use hmac-sha2-256-etm@openssh.com or hmac-sha2-512-etm@openssh.com. ================================================================================ HOST 5: 192.168.10.50 (monitoring-01) OS Detected: Rocky Linux 9.3 Open Ports: 22/tcp, 3000/tcp, 9090/tcp, 9093/tcp ================================================================================ [22] HIGH — CVE-2024-1313 (Grafana IDOR) CVSS v3.1: 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118488 Port: 3000/tcp Software: Grafana 10.2.3 Description: Insecure Direct Object Reference allows low-privilege users to delete dashboards owned by other organizations. Fix: Upgrade Grafana to 10.2.5+ or 10.3.3+. [23] MEDIUM — CVE-2024-4068 (braces ReDoS) CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.118502 Port: 3000/tcp Software: Grafana 10.2.3 (bundled Node.js dependency) Description: Regular expression denial of service in braces package used by Grafana's frontend build. Fix: Upgrade Grafana to latest version (includes patched braces). [24] MEDIUM — Prometheus Unauthenticated Access CVSS v3.1: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.114200 Port: 9090/tcp Software: Prometheus 2.48.1 Description: Prometheus web UI and API are accessible without authentication. Internal metrics, service discovery configs, and target labels are exposed. This may reveal internal hostnames, IP addresses, and architecture details. Fix: Enable basic auth or use a reverse proxy with authentication. Restrict network access to trusted IPs only. [25] LOW — Alertmanager Version Disclosure CVSS v3.1: 0.0 (Informational) Plugin ID: OID:1.3.6.1.4.1.25623.1.0.114201 Port: 9093/tcp Software: Alertmanager 0.26.0 Description: Alertmanager exposes its version number and build information at the /api/v1/status endpoint without authentication. Fix: Restrict access to Alertmanager API to authenticated users. ================================================================================ SUMMARY BY SEVERITY ================================================================================ CRITICAL: 3 (CVE-2021-44228, CVE-2017-0144, CVE-2024-23897) HIGH: 7 (CVE-2023-48795, CVE-2024-6387, CVE-2023-22515, CVE-2024-20961, CVE-2024-31449, Redis unauth, CVE-2024-1313, EOL OS) MEDIUM: 9 (Missing headers, SHA-1 cert, CVE-2023-5678, CVE-2024-28849, TLS 1.0/1.1, CVE-2024-21626, Jenkins CSRF, CVE-2024-4068, Prometheus unauth) LOW: 6 (Banner disclosure, ICMP timestamp, directory listing, weak SSH MACs, Alertmanager disclosure) TOTAL: 25 ================================================================================ HOSTS WITH CRITICAL FINDINGS ================================================================================ 192.168.10.10 web-prod-01 Log4Shell (CVE-2021-44228) 192.168.10.20 db-prod-01 EternalBlue / SMBv1 (CVE-2017-0144) 192.168.10.40 ci-runner-02 Jenkins File Read (CVE-2024-23897) ================================================================================ END OF REPORT ================================================================================