Apache Tomcat 11.0.0.M1 < 11.0.23 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(323713);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id(
    "CVE-2026-50229",
    "CVE-2026-53404",
    "CVE-2026-53434",
    "CVE-2026-55276",
    "CVE-2026-55955",
    "CVE-2026-55956"
  );

  script_xref(name:"IAVA", value:"2026-A-0642");

  script_name(english:"Apache Tomcat 11.0.0.M1 < 11.0.23 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 11.0.23. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.23_security-11 advisory.

  - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number
    guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from
    10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through
    7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to
    upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue. (CVE-2026-50229)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the
    default servlet ignoring any method or method omission configured as part of the constraint. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached
    end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the
    EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from
    7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which
    fixes the issue. (CVE-2026-55955)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and
    empty authorisation constraints were not included when the effective web.xml was logged. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be
    affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM
    based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through
    10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fixes the issue. (CVE-2026-53434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/3f6bd2ba5e53d1f340bbe5ad2d42a28b29440b7a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fa19cb5b");
  # https://github.com/apache/tomcat/commit/5e594400c7f6ac0eaf2526bd64442a70f5ccaace
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4995cbef");
  # https://github.com/apache/tomcat/commit/f844614c6d92eeb11e81e179606bf4c390f642dd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7955069b");
  # https://github.com/apache/tomcat/commit/e391c6b201eae2ad9707a1335aff68ab8b3e0f84
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4afb5180");
  # https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4de970f3");
  # https://github.com/apache/tomcat/commit/b647cb584cea8bf95e64f5d2526c59ab8fca3225
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d8e81d13");
  # https://github.com/apache/tomcat/commit/1fe95d841e9d461a16069974142d12c3ef68819a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?179e0f8c");
  # https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.23
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9a71db42");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 11.0.23 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50229");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-55276");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '11.0.0.M1', 'max_version' : '11.0.22', 'fixed_version' : '11.0.23' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);