Plone 2.5.x < 2.5.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329036);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2006-4247", "CVE-2006-4249");

  script_name(english:"Plone 2.5.x < 2.5.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Plone installed on the remote host is 2.5.x prior to 2.5.2. It is, therefore, affected by the following
vulnerabilities:

  - Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate
    allows attackers to reset the passwords of other users, related to 'an erroneous security declaration'.
    (CVE-2006-4247)

  - Unspecified vulnerability in PlonePAS allows an attacker to 'masquerade as a group'. (CVE-2006-4249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://web.archive.org/web/20070310200655/http://plone.org/about/security/advisories/cve-2006-4247/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ce60cadb");
  # https://web.archive.org/web/20061116083529/http://plone.org/about/security/advisories/cve-2006-4249/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6b8e27b9");
  script_set_attribute(attribute:"see_also", value:"https://exchange.xforce.ibmcloud.com/vulnerabilities/30762");
  script_set_attribute(attribute:"see_also", value:"https://exchange.xforce.ibmcloud.com/vulnerabilities/41425");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Plone version 2.5.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2006-4247");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2006/11/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:plone");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("installed_sw/plone");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'plone', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2.5', 'fixed_version': '2.5.2'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);