Tenable Nessus 10.8.0 <= 10.8.6 / 10.9.0 < 10.9.6 / 10.10.0 <= 10.10.1 / 10.11.0 < 10.11.1 Multiple Vulnerabilities (TNS-2025-24)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278743);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id(
    "CVE-2024-8176",
    "CVE-2024-55549",
    "CVE-2025-6021",
    "CVE-2025-6170",
    "CVE-2025-7425",
    "CVE-2025-10911",
    "CVE-2025-11731",
    "CVE-2025-49794",
    "CVE-2025-49796",
    "CVE-2025-59375"
  );
  script_xref(name:"IAVA", value:"2026-A-0153");

  script_name(english:"Tenable Nessus 10.8.0 <= 10.8.6 / 10.9.0 < 10.9.6 / 10.10.0 <= 10.10.1 / 10.11.0 < 10.11.1 Multiple Vulnerabilities (TNS-2025-24)");

  script_set_attribute(attribute:"synopsis", value:
"An instance of Nessus installed on the remote system is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Tenable Nessus application running on the remote host is 10.8.0 prior or 
equal to 10.8.6, 10.9.0 prior to 10.9.6, 10.10.0 prior or equal to 10.10.1 and 10.11.0 prior to 10.11.1. It is, 
therefore, affected by multiple vulnerabilities as referenced in the TNS-2025-24 advisory.

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result
    prefixes. (CVE-2024-55549)

  - A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under
    certain circumstances when the XML schematron has the <sch:name path=.../> schema elements. This flaw
    allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the
    program's crash using libxml or other possible undefined behaviors. (CVE-2025-49794)

  - A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can
    trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that
    can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to
    sensitive data being corrupted in memory. (CVE-2025-49796)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://docs.tenable.com/release-notes/Content/nessus/2025.htm#10.9.6");
  script_set_attribute(attribute:"see_also", value:"https://docs.tenable.com/release-notes/Content/nessus/2025.htm#10.11.1");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/TNS-2025-24");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Tenable Nessus 10.9.6, 10.11.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-49796");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2024-55549");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_severity", value:"Critical");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/12/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/12/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:nessus");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nessus_detect.nasl", "nessus_installed_win.nbin", "nessus_installed_linux.nbin", "macos_nessus_installed.nbin");
  script_require_keys("installed_sw/Tenable Nessus");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app_info = vcf::combined_get_app_info(app:'Tenable Nessus');

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '10.8.0', 'max_version' : '10.8.6', 'fixed_version' : '10.9.6' },
  { 'min_version' : '10.9.0', 'fixed_version' : '10.9.6' },
  { 'min_version' : '10.10.0', 'max_version' : '10.10.1', 'fixed_version' : '10.11.1' },
  { 'min_version' : '10.11.0', 'fixed_version' : '10.11.1' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);