Apache Tomcat 10.1.0.M1 < 10.1.56 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(323712);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/30");

  script_cve_id(
    "CVE-2026-50229",
    "CVE-2026-53404",
    "CVE-2026-53434",
    "CVE-2026-55276",
    "CVE-2026-55955",
    "CVE-2026-55956"
  );

  script_name(english:"Apache Tomcat 10.1.0.M1 < 10.1.56 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 10.1.56. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.56_security-10 advisory.

  - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number
    guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from
    10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through
    7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to
    upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue. (CVE-2026-50229)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the
    default servlet ignoring any method or method omission configured as part of the constraint. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached
    end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the
    EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from
    7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which
    fixes the issue. (CVE-2026-55955)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and
    empty authorisation constraints were not included when the effective web.xml was logged. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be
    affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM
    based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through
    10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fixes the issue. (CVE-2026-53434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/9c3b1efb74fd04f77639720af1d48a8f664ad9bb
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75ca2361");
  # https://github.com/apache/tomcat/commit/3a9ff01d2dfaca651edacbda3260e37b98b540d3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dda56330");
  # https://github.com/apache/tomcat/commit/25677f90fd721c26ef0f613d34ef8275b1aafc31
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?32e1a92d");
  # https://github.com/apache/tomcat/commit/17daf80a738d66a8e6cad05c5e32c2db81500ce1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1e17d4c9");
  # https://github.com/apache/tomcat/commit/feec60d6099727db6f911534f6a0f6926ebab070
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5ef0fbbe");
  # https://github.com/apache/tomcat/commit/bbb6219fa5ac185060bef7842cee5fb90230ca00
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f4e29f84");
  # https://github.com/apache/tomcat/commit/0d5bdd5b0dd964e9f73e530b7d753462b9bfd1d0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?af7e1f6d");
  # https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.56
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?21b6337f");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 10.1.56 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50229");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '10.1.0.M1', 'max_version' : '10.1.55', 'fixed_version' : '10.1.56' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);