Apache Roller < 6.1.5 Insufficient Session Expiration on Password Change (CVE-2025-24859)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276820);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/03");

  script_cve_id("CVE-2025-24859");

  script_name(english:"Apache Roller < 6.1.5 Insufficient Session Expiration on Password Change (CVE-2025-24859)");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server hosts a Java application that is affected by a session management vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the instance of Apache Roller running on the remote host is prior to 
6.1.5. It is, therefore, affected by a session management vulnerability where active user sessions are not properly 
invalidated after password changes. When a user's password is changed, either by the user themselves or by an 
administrator, existing sessions remain active and usable. This allows continued access to the application through 
old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Roller version 6.1.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-24859");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:roller");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_roller_detect.nbin");
  script_require_keys("installed_sw/Apache Roller");
  script_require_ports("Services/www", 443, 8080);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'Apache Roller';
var port = get_http_port(default:8080);

var app_info = vcf::get_app_info(app:app, port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '1.0.0', 'fixed_version' : '6.1.5' }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);