Apache CXF 3.5.10 / 3.6.5 / 4.0.6 / 4.1.0 DoS (CVE-2025-48795)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242260);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-48795");
  script_xref(name:"IAVB", value:"2025-B-0119-S");

  script_name(english:"Apache CXF 3.5.10 / 3.6.5 / 4.0.6 / 4.1.0 DoS (CVE-2025-48795)");

  script_set_attribute(attribute:"synopsis", value:
"Apache CXF is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache CXF installed on the remote host is 3.5.10, 3.6.5, 4.0.6, or 4.1.0. It is, therefore, affected by
a denial of service vulnerability:

  - Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which
    means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this
    to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure
    CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local
    filesystem, however this bug means that the cached files are written out to logs unencrypted. Users are recommended
    to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue. (CVE-2025-48795)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://lists.apache.org/thread/vo5qv02mvv5plmb6z2xf1ktjmrpv3jmn
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e85877c");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache CXF version 3.5.11, 3.6.6, 4.0.7, or 4.1.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48795");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:cxf");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_cxf_detect.nbin");
  script_require_keys("installed_sw/Apache CXF");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache CXF', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version':'3.5.10', 'fixed_version':'3.5.11'},
        { 'min_version':'3.6.5', 'fixed_version':'3.6.6'},
        { 'min_version':'4.0.6', 'fixed_version':'4.0.7'},
        { 'min_version':'4.1.0', 'fixed_version':'4.1.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);