IBM App Connect Enterprise runtime lack of authorization (IWA) (7249061)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271960);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/31");

  script_cve_id("CVE-2025-36361");
  script_xref(name:"IAVB", value:"2025-B-0179");

  script_name(english:"IBM App Connect Enterprise runtime lack of authorization (IWA) (7249061)");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by a lack of authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated 
user to perform unauthorized actions on customer defined resources due to missing authorization.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7249061");
  script_set_attribute(attribute:"solution", value:
"Upgrade IBM App Connect Enterprise to the minimal fix pack levels required by the interim fix and then apply Interim Fix IT48403.");
  script_set_attribute(attribute:"agent", value:"all");

  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-36361");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:app_connect_enterprise");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_ace_linux_installed.nbin", "ibm_ace_win_installed.nbin");
  script_require_keys("installed_sw/IBM App Connect Enterprise");

  exit(0);
}

include('vcf.inc');

var app = 'IBM App Connect Enterprise';
var fix = 'Interim Fix IT48403';

var app_info = vcf::get_app_info(app:app);
vcf::check_granularity(app_info:app_info, sig_segments:4);

if ('48403' >< app_info['Interim Fix'])
  audit(AUDIT_INST_VER_NOT_VULN, app);

var constraints = [
  { 'min_version' : '13.0.1.0', 'max_version' : '13.0.4.2', 'fixed_display' : '13.0.5.0 ' + fix },
  { 'min_version' : '12.0.1.0', 'max_version' : '12.0.12.17', 'fixed_display' : '12.0.12.18 ' + fix }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);