Plone 2.5.x < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 / 4.1.x < 4.1.1 Multiple Vulnerabilities (HF 20110531)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329001);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2011-1948", "CVE-2011-1949", "CVE-2011-1950");

  script_name(english:"Plone 2.5.x < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 / 4.1.x < 4.1.1 Multiple Vulnerabilities (HF 20110531)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Plone installed on the remote host is 2.5.x prior to 2.5.5, 3.x prior to 3.3.6, 4.x prior to 4.0.4, 4.1.x
prior to 4.1.1. It is, therefore, affected by the following vulnerabilities:

  - Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a
    crafted URL (CVE-2011-1948)

  - Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms allows remote
    authenticated users to inject arbitrary web script or HTML via unspecified vectors (CVE-2011-1949)

  - plone.app.users allows remote authenticated users to modify the properties of arbitrary accounts via unspecified
    vectors, as exploited in the wild in June 2011 (CVE-2011-1950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number. Since a vendor hotfix (PloneHotfix20110531) may remediate this without a version upgrade, this plugin only
reports when running in Paranoid mode.");
  script_set_attribute(attribute:"see_also", value:"https://plone.org/security/hotfix/20110531");
  # https://web.archive.org/web/20140722010717/http://plone.org/products/plone-hotfix/releases/20110531
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0cb4f22");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor hotfix (Products.PloneHotfix20110531), or upgrade to Plone version 2.5.5, 3.3.6, 4.0.4, 4.1.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-1950");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:plone");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("installed_sw/plone", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'plone', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'paranoia': true}}],
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2.5', 'fixed_version': '2.5.5'},
        {'min_version': '3', 'fixed_version': '3.3.6'},
        {'min_version': '4', 'fixed_version': '4.0.4'},
        {'min_version': '4.1', 'fixed_version': '4.1.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:true, flags:{'xss': true});
vdf::handle_check_and_report_errors(vdf_result:result);