ManageEngine Endpoint Central 11.3.2428.x <= 11.3.2428.01, 11.3.2440.x <= 11.3.2440.0 Insecure Direct Object References

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(216265);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/23");

  script_cve_id("CVE-2024-9097");
  script_xref(name:"IAVA", value:"2025-A-0115");

  script_name(english:"ManageEngine Endpoint Central 11.3.2428.x <= 11.3.2428.01, 11.3.2440.x <= 11.3.2440.0 Insecure Direct Object References");

  script_set_attribute(attribute:"synopsis", value:
"The remote ManageEngine Endpoint Central host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of ManageEngine Endpoint Central installed on the remote Windows host is either prior to 11.3.2428.26 
or prior to 11.3.2440.09. It is,therefore, affected by an insecure direct object references vulnerability. For more 
information, consult the vendor advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.manageengine.com/products/desktop-central/cve-2024-9097.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d7815773");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ManageEngine Endpoint Central versions 11.3.2428.26, 11.3.2440.09 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-9097");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/12/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/14");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zohocorp:manageengine_endpoint_central");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("manageengine_desktop_central_installed.nbin");
  script_require_keys("installed_sw/ManageEngine Desktop Central");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'ManageEngine Desktop Central');

var constraints = [
  { 'max_version' : '11.3.2428.01', 'fixed_display' : '11.3.2428.26' },
  { 'min_version' : '11.3.2429.0.0', 'max_version' : '11.3.2440.0', 'fixed_display' : '11.3.2440.09' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);