Plone products.isurlinportal < 2.1.0 / 3.x < 3.1.0 Open Redirect

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329005);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2026-28413");

  script_name(english:"Plone products.isurlinportal < 2.1.0 / 3.x < 3.1.0 Open Redirect");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an open redirect vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of products.isurlinportal installed on the remote host is prior to 2.1.0, or 3.x prior to 3.1.0. It is,
therefore, affected by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the url
/login?came_from=////evil.example, to redirect to an external website after login.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/plone/Products.isurlinportal/security/advisories/GHSA-43gx-6gv6-3jcp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?869c1695");
  script_set_attribute(attribute:"solution", value:
"Upgrade to products.isurlinportal version 2.1.0, 3.1.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-28413");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(601);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:products.isurlinportal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'products.isurlinportal';
var cpe = 'cpe:/a:plone:products.isurlinportal';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);
if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  {'fixed_version': '2.1.0'},
  {'min_version': '3.0.0', 'fixed_version': '3.1.0'}
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_WARNING);