Apache Tomcat 10.1.0.M1 < 10.1.42 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240058);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-48976",
    "CVE-2025-48988",
    "CVE-2025-49124",
    "CVE-2025-49125",
    "CVE-2025-55668"
  );
  script_xref(name:"IAVA", value:"2025-A-0437-S");
  script_xref(name:"IAVA", value:"2025-A-0582-S");

  script_name(english:"Apache Tomcat 10.1.0.M1 < 10.1.42 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 10.1.42. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.42_security-10 advisory.

  - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the
    Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache
    Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The
    following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through
    8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or
    9.0.106, which fix the issue. (CVE-2025-49124)

  - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL
    versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106,
    which fix the issue. (CVE-2025-55668)

  - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using
    PreResources or PostResources mounted other than at the root of the web application, it was possible to
    access those resources via an unexpected path. That path was likely not to be protected by the same
    security constraints as the expected path, allowing those security constraints to be bypassed. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1
    through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be
    affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to
    upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49125)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects
    Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through
    9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to
    version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-48988)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in
    Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from
    2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the
    issue. (CVE-2025-48976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/7617b9c247bc77ed0444dd69adcd8aa48777886c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a58cc537");
  # https://github.com/apache/tomcat/commit/e0e07812224d327a321babb554f5a5758d30cc49
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b4b576bb");
  # https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ebc35116");
  # https://github.com/apache/tomcat/commit/cdde8e655bc1c5c60a07efd216251d77c52fd7f6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6c829403");
  # https://github.com/apache/tomcat/commit/667ddd76e2a0e762f3a784d86f0d25e7fd7cdb86
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7028c9e2");
  # https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.42
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1eebf84d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 10.1.42 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55668");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-49124");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-48988");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '10.1.0.M1', 'max_version' : '10.1.41', 'fixed_version' : '10.1.42' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);