Apache Tomcat 10.1.0.M1 < 10.1.59 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339371);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id(
    "CVE-2026-65182",
    "CVE-2026-65183",
    "CVE-2026-65637",
    "CVE-2026-65905",
    "CVE-2026-65927",
    "CVE-2026-66299",
    "CVE-2026-66422",
    "CVE-2026-68525",
    "CVE-2026-68569",
    "CVE-2026-68763",
    "CVE-2026-73180"
  );

  script_name(english:"Apache Tomcat 10.1.0.M1 < 10.1.59 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 10.1.59. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.59_security-10 advisory.

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue
    affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through
    9.0.120. Users who have followed the security guidance to remove the examples web application are not
    affected by this issue. Users are recommended to remove the examples web application or to upgrade to
    version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. (CVE-2026-66299)

  - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an
    authenticated HTTP session was changed after a WebSocket connection had been established under that
    authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket
    specification when the HTTP session ended. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at
    the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through
    7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.25, 10.1.58 or 9.0.121, which fix the issue. (CVE-2026-73180)

  - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2
    backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24,
    from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were EOL at the time
    the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions
    may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix
    the issue. (CVE-2026-68763)

  - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT,
    SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This
    issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1
    through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be
    affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.
    (CVE-2026-68569)

  - Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing
    of a security constraint that limits user has access to a resource POST but not GET. This issue affects
    Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through
    9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected:
    from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
    Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.
    (CVE-2026-68525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/83427cbdb92ca41244dc3d242ca4308ed8ade7d3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?36597509");
  # https://github.com/apache/tomcat/commit/7d2ae3952a39db5790dcfd36e5d79c75570a20ee
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54132e82");
  # https://github.com/apache/tomcat/commit/40012414df828a56126f76a7339669c7c919aae7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5f9e7524");
  # https://github.com/apache/tomcat/commit/49506f6d5ad7cdef211ce1a4026a29183b3df5c7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7d73bff1");
  # https://github.com/apache/tomcat/commit/446efef55c69b0cabde1f7e582382cb26e651022
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc78cb85");
  # https://github.com/apache/tomcat/commit/d8bcec9a30788fd887f33890b77ae1b8cd5f1f7e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bcb60cb1");
  # https://github.com/apache/tomcat/commit/3ff06ceb984edc2a3c9e0161b01e833c5e50ed4f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?de0984e6");
  # https://github.com/apache/tomcat/commit/19d40615620fe145e88536e2bd63c5f01077c253
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e707adb9");
  # https://github.com/apache/tomcat/commit/1c1a583ba57092206f77c375f45da12c99fb141d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ffae1234");
  # https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.59
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?838b3b73");
  # https://github.com/apache/tomcat/commit/3097902177a041a93476a036b9c8419b25d5cc0d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9ffc015a");
  # https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a728e43e");
  # https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b2b73791");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 10.1.59 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-66299");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '10.1.0.M1', 'max_version' : '10.1.57', 'fixed_version' : '10.1.59' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);