IBM Engineering Requirements Management DOORS Next Improper Access Control (7261900)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300595);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/09");

  script_cve_id("CVE-2025-13734");
  script_xref(name:"IAVA", value:"2026-A-0194");

  script_name(english:"IBM Engineering Requirements Management DOORS Next Improper Access Control (7261900)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of IBM Engineering Requirements Management DOORS Next installed on the remote
host is 7.1.0 prior to 7.1.0 ifix 08 or 7.2.0 prior to 7.2.0 ifix 01. It is, therefore,
affected by a vulnerability as referenced in the 7261900 advisory.

  - IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an
    authenticated user to view and edit data beyond their authorized access permissions.
    (CVE-2025-13734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7261900");
  script_set_attribute(attribute:"solution", value:
"Install 7.1.0 ifix 08 or 7.2.0 ifix 01 based upon the guidance specified in 7261900.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-13734");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:rational_doors");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_enum_products.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/IBM Engineering Requirements Management DOORS Next");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');
var app_info = vcf::ibm_doors_next::get_appinfo();

var constraints = [
  { 'min_version' : '7.1.0', 'fixed_version' : '7.1.0.8', 'fixed_display' : '7.1.0 iFix 08' },
  { 'min_version' : '7.2.0', 'fixed_version' : '7.2.0.1', 'fixed_display' : '7.2.0 iFix 01' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);