Plone products.isurlinportal < 1.2.0 Open Redirect

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329014);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2021-32806");

  script_name(english:"Plone products.isurlinportal < 1.2.0 Open Redirect");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an open redirect vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Plone products.isurlinportal installed on the remote host is prior to 1.2.0. It is, therefore, affected
by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the 'is url in portal', to
redirect to an external website after login.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://jvn.jp/en/jp/JVN50804280/index.html");
  # https://github.com/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2d68efd3");
  # https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d30bdb1d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Plone products.isurlinportal version 1.2.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-32806");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(601);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:products.isurlinportal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'products.isurlinportal';
var cpe = 'cpe:/a:plone:products.isurlinportal';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);
if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  {'fixed_version': '1.2.0'}
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_WARNING);