Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329016);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2022-24740");

  script_name(english:"Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an insecure authentication vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to
15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their
authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the
other user's account and privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/pull/3051");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/security/advisories/GHSA-cfhh-xgwq-5r67");
  script_set_attribute(attribute:"solution", value:
"Upgrade to @plone/volto version 14.10.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-24740");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/03/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/03/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

var app = '@plone/volto';
var app_info = vcf_extras::nodejs_modules::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

var constraints = [
  {'min_version': '14.0.0-alpha.6', 'fixed_version': '15.0.0-alpha.0', 'fixed_display': 'See vendor advisory'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);