IBM WebSphere eXtreme Scale 8.6.2.0 < 8.6.2.2 (7282872)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333386);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/08");

  script_cve_id(
    "CVE-2021-23337",
    "CVE-2025-13465",
    "CVE-2026-2950",
    "CVE-2026-4800",
    "CVE-2026-9002",
    "CVE-2026-33937",
    "CVE-2026-33939"
  );

  script_name(english:"IBM WebSphere eXtreme Scale 8.6.2.0 < 8.6.2.2 (7282872)");

  script_set_attribute(attribute:"synopsis", value:
"The remote web application server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.2.2 IBM. It is, therefore,
affected by multiple vulnerabilities as referenced in the 7282872 advisory.

  - Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
    (CVE-2021-23337)

  - Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation
    for the variable option in _.template but did not apply the same validation to options.imports key names.
    Both paths flow into the same Function() constructor sink. When an application passes untrusted input as
    options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary
    code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which
    enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector,
    the polluted keys are copied into the imports object and passed to Function(). Patches: Users should
    upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only
    use developer-controlled, static key names. (CVE-2026-4800)

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-
    xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing
    array-wrapped path segments. This allows deletion of properties from built-in prototypes such as
    Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype
    properties but does not allow overwriting their original behavior. Patches: This issue is patched in
    4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7282872");
  script_set_attribute(attribute:"solution", value:
"Please see vendor advisory for details.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-23337");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-4800");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-13465");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/02/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/08");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_extreme_scale");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_websphere_extreme_scale_nix_installed.nbin");
  script_require_keys("installed_sw/IBM WebSphere eXtreme Scale", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
var app_info = vcf::get_app_info(app:'IBM WebSphere eXtreme Scale');

if (app_info['version'] =~ "^8\.6\.2" && report_paranoia < 2)
    audit(AUDIT_PARANOID);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '8.6.2.0', 'fixed_version' : '8.6.2.2', 'missing_patch' : 'PH72363', 'fixed_display' : 'Please see vendor advisory for details.' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);