Apache Tomcat 10.1.0.M1 < 10.1.60 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349470);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/25");

  script_cve_id(
    "CVE-2026-73581",
    "CVE-2026-75973",
    "CVE-2026-76183",
    "CVE-2026-77756",
    "CVE-2026-77762",
    "CVE-2026-77791",
    "CVE-2026-78383",
    "CVE-2026-78437",
    "CVE-2026-79677",
    "CVE-2026-86248",
    "CVE-2026-86350",
    "CVE-2026-87022"
  );
  script_xref(name:"IAVA", value:"2026-A-1039");

  script_name(english:"Apache Tomcat 10.1.0.M1 < 10.1.60 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 10.1.60. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.60_security-10 advisory.

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from
    10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26,
    10.1.60 or 9.0.122, which fix the issue. (CVE-2026-86248)

  - Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an
    unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be
    affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    (CVE-2026-78383)

  - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM
    TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following
    versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through
    8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.59, 9.0.122, which fixes the issue. (CVE-2026-73581)

  - Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with
    SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the
    realm for the first web application to authenticate a request would be used for all web applications. This
    issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4
    through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be
    affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are
    recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. (CVE-2026-75973)

  - Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints
    for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at
    the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through
    7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version
    11.0.26, 10.1.60 or 9.0.122, which fix the issue. (CVE-2026-76183)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/567a85515b78d1cd6410a89844b88109fcc2306f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3bfaf81");
  # https://github.com/apache/tomcat/commit/259e938d3dedf07f3b24189fd5032adb95b01f2a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b5644b62");
  # https://github.com/apache/tomcat/commit/e5191b1e3292681097503f093b5432451ff5aa83
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f63b9b46");
  # https://github.com/apache/tomcat/commit/bb676e53cd0bdcbecfe9650841e99973a7693f7e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?97ce4267");
  # https://github.com/apache/tomcat/commit/4ac5da0906c500f6042844d7f17e9fb174820758
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e8a4c64");
  # https://github.com/apache/tomcat/commit/2ed6d18ebfe4b085ef050dd0a0f4f20aff3bc48d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3cfc27cc");
  # https://github.com/apache/tomcat/commit/e896f73c868f66dfb2a93565fda4d13cd5909d2d
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f53e7463");
  # https://github.com/apache/tomcat/commit/77d2d59347891eced52b0cb5a979fc33a8a2620c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f78613a4");
  # https://github.com/apache/tomcat/commit/bf44bee23d97fbb1a64cbbbb213ff2b6506d26c4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a71bb3b");
  # https://github.com/apache/tomcat/commit/5b48790abd13d94c2bd351027a39a671916b5ddf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4b8986bd");
  # https://github.com/apache/tomcat/commit/f62c65768fdaa300e22e64ffa7b5118dce0571a1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c574ae2c");
  # https://github.com/apache/tomcat/commit/6907d47ea2d4c3f13ef9f65b0c51ff2fd485c252
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3917db48");
  # https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.60
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5ae5700");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 10.1.60 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78383");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-86248");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:10");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '10.1.0.M1', 'max_version' : '10.1.59', 'fixed_version' : '10.1.60' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);