Cisco Application Policy Infrastructure Controller Access Control (CVE-2016-1302)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501330);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2016-1302");

  script_name(english:"Cisco Application Policy Infrastructure Controller Access Control (CVE-2016-1302)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Cisco Application Policy Infrastructure Controller (APIC) devices with
software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode
switches with software before 11.0(3h) and 11.1 before 11.1(1j) allow
remote authenticated users to bypass intended RBAC restrictions via
crafted REST requests, aka Bug ID CSCut12998.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-apic
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d13f2558");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1034925");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1302");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/02/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%281b%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%281c%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%281d%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%281e%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%282j%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%282m%5c%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:11.0%5c%283f%5c%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:11.0%5c%281b%5c%29" :
        {"versionEndIncluding" : "11.0%5c%281b%5c%29", "versionStartIncluding" : "11.0%5c%281b%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%281c%5c%29" :
        {"versionEndIncluding" : "11.0%5c%281c%5c%29", "versionStartIncluding" : "11.0%5c%281c%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%281d%5c%29" :
        {"versionEndIncluding" : "11.0%5c%281d%5c%29", "versionStartIncluding" : "11.0%5c%281d%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%281e%5c%29" :
        {"versionEndIncluding" : "11.0%5c%281e%5c%29", "versionStartIncluding" : "11.0%5c%281e%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%282j%5c%29" :
        {"versionEndIncluding" : "11.0%5c%282j%5c%29", "versionStartIncluding" : "11.0%5c%282j%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%282m%5c%29" :
        {"versionEndIncluding" : "11.0%5c%282m%5c%29", "versionStartIncluding" : "11.0%5c%282m%5c%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:11.0%5c%283f%5c%29" :
        {"versionEndIncluding" : "11.0%5c%283f%5c%29", "versionStartIncluding" : "11.0%5c%283f%5c%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);