Apache Tomcat 11.0.15 < 11.0.20 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306755);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/20");

  script_cve_id(
    "CVE-2026-24880",
    "CVE-2026-25854",
    "CVE-2026-29129",
    "CVE-2026-29145",
    "CVE-2026-29146",
    "CVE-2026-32990"
  );
  script_xref(name:"IAVA", value:"2026-A-0319");

  script_name(english:"Apache Tomcat 11.0.15 < 11.0.20 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 11.0.20. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.20_security-11 advisory.

  - Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the
    LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from
    10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported
    versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116,
    which fix the issue. (CVE-2026-25854)

  - Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This
    issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113
    through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the
    issue. (CVE-2026-32990)

  - Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through
    9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to
    version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue. (CVE-2026-29146)

  - CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
    vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1
    through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from
    1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.
    Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and
    9.0.116, which fix the issue. (CVE-2026-29145)

  - Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache
    Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users
    are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue. (CVE-2026-29129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/021d1f833e38b683a44688f7b28f1f27e8e37c36
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?af5b57c2");
  # https://github.com/apache/tomcat/commit/6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b688dd1b");
  # https://github.com/apache/tomcat/commit/721591f7bff424c693f26adc18ae9b9abac3655b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f4bc82f3");
  # https://github.com/apache/tomcat/commit/5cfa876d73f1ff5f4dc8309c4320f684cbeff74e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a69d5c01");
  # https://github.com/apache/tomcat/commit/4c5d306001b780c9316aea5ff6502c524fb20695
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?47ab769c");
  # https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad01be52");
  # https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ff8736ec");
  # https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1111ed1e");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 11.0.20 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25854");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-29145");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '11.0.15', 'max_version' : '11.0.19', 'fixed_version' : '11.0.20' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);