IBM App Connect Enterprise (ACE) Path Traversal (7182418)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(245203);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-0799");
  script_xref(name:"IAVB", value:"2025-B-0019-S");

  script_name(english:"IBM App Connect Enterprise (ACE) Path Traversal (7182418)");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by a path traversal vulnerability.");
  script_set_attribute(attribute:"description", value:
"IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user 
to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on 
restricted directories.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7182418");
  script_set_attribute(attribute:"solution", value:
"Upgrade IBM App Connect Enterprise to the minimal fix pack levels required by the interim fix and then apply Interim Fix IT47533.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-0799");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/02/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:app_connect_enterprise");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_ace_linux_installed.nbin", "ibm_ace_win_installed.nbin");
  script_require_keys("installed_sw/IBM App Connect Enterprise");

  exit(0);
}

include('vcf.inc');

var app = 'IBM App Connect Enterprise';
var fix = 'Interim Fix IT47533';

var app_info = vcf::get_app_info(app:app);
vcf::check_granularity(app_info:app_info, sig_segments:4);

if ('47533' >< app_info['Interim Fix'])
  audit(AUDIT_INST_VER_NOT_VULN, app);

var constraints = [
 { 'min_version' : '12.0.1.0', 'max_version' : '12.0.12.10', 'fixed_display' : '12.0.12.10 ' + fix },
 { 'min_version' : '13.0.1.0', 'max_version' : '13.0.2.1', 'fixed_display' : '13.0.2.1 ' + fix }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);