Plone 2.5.5 < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20170117)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329022);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2016-7147", "CVE-2017-5524");

  script_name(english:"Plone 2.5.5 < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20170117)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Plone installed on the remote host is 2.5.5 prior to 4.3.12, or 5.0.x prior to 5.0.7. It is, therefore,
affected by the following vulnerabilities:

  - Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope
    ZMI in Plone allows remote attackers to inject arbitrary web script or HTML via vectors involving double
    quotes, as demonstrated by the obj_ids:tokens parameter. (CVE-2016-7147)

  - Plone allows remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by
    leveraging the Python string format method. (CVE-2017-5524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number. Since a vendor hotfix (PloneHotfix20170117) may remediate this without a version upgrade, this plugin only
reports when running in Paranoid mode.");
  script_set_attribute(attribute:"see_also", value:"https://plone.org/security/hotfix/20170117");
  script_set_attribute(attribute:"solution", value:
"Apply the vendor hotfix (Products.PloneHotfix20170117), or upgrade to Plone version 4.3.12, 5.0.7, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7147");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/01/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/01/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:plone:plone");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("installed_sw/plone", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'plone', 'type': 'app'},
      'requires': [{'scope': 'target', 'match': {'paranoia': true}}],
      'check_algorithm': 'default',
      'constraints': [
        {
          'min_version': '2.2.5', 'fixed_version': '4', 'fixed_display': '4.3.12',
          'report': {'cves': ['CVE-2016-7147']}
        },{
          'min_version': '4', 'fixed_version': '4.3.12'
        },{
          'min_version': '5', 'fixed_version': '5.0.7'
        }
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:true, flags:{'xss': true});
vdf::handle_check_and_report_errors(vdf_result:result);