Plone < 3.1.8 MitM

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(328999);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2008-1396");

  script_name(english:"Plone < 3.1.8 MitM");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a man-in-the-middle vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Plone installed on the remote host is prior to 3.1.8. It is, therefore, affected by a man-in-the-middle
vulnerability. Plone uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for
an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing
the network.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cxsecurity.com/issue/WLB-2008030047");
  script_set_attribute(attribute:"see_also", value:"https://exchange.xforce.ibmcloud.com/vulnerabilities/41421");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-hjp5-hv33-q58g");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor hotfix, or upgrade to Plone version 3.1.8 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2008-1396");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2008/03/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2008/03/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:plone");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("installed_sw/plone");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'plone', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '3.1.8'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:true);
vdf::handle_check_and_report_errors(vdf_result:result);