Atlassian Confluence < 8.5.17 / 8.6.x < 9.2.6 / 9.3.1 < 9.4.0 / 9.5.x < 9.5.1 / 10.0.x < 10.0.2 (CONFSERVER-101480)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(282324);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/07");

  script_cve_id("CVE-2024-45296");
  script_xref(name:"IAVA", value:"2025-A-0870");

  script_name(english:"Atlassian Confluence < 8.5.17 / 8.6.x < 9.2.6 / 9.3.1 < 9.4.0 / 9.5.x < 9.5.1 / 10.0.x < 10.0.2 (CONFSERVER-101480)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Atlassian Confluence host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in
the CONFSERVER-101480 advisory.

  - path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output
    a regular expression that can be exploited to cause poor performance. Because JavaScript is single
    threaded and regex matching runs on the main thread, poor performance will block the event loop and lead
    to a DoS. The bad regular expression is generated any time you have two parameters within a single
    segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other
    users should upgrade to 8.0.0. (CVE-2024-45296)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.atlassian.com/browse/CONFSERVER-101480");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Atlassian Confluence version 8.5.17, 9.2.6, 9.4.0, 9.5.1, 10.0.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-45296");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:confluence");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("confluence_detect.nasl", "confluence_nix_installed.nbin", "confluence_win_installed.nbin");
  script_require_keys("installed_sw/Atlassian Confluence");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Atlassian Confluence');

var constraints = [
  { 'min_version' : '7.19.0','max_version' : '7.19.9999','fixed_version' : '8.5.17' },
  { 'min_version' : '8.5.0','fixed_version' : '8.5.17' },
  { 'min_version' : '8.6.0','max_version' : '8.6.9999',  'fixed_version' : '9.2.6' },
  { 'min_version' : '8.7.1','max_version' : '8.9.9999',  'fixed_version' : '9.2.6' },
  { 'min_version' : '9.0.1','fixed_version' : '9.2.6' },
  { 'min_version' : '9.3.1', 'fixed_version' : '9.4.0' },
  { 'min_version' : '9.5.0', 'fixed_version' : '9.5.1' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.2' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);