Apache Tomcat 11.0.0.M1 < 11.0.8 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240059);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-48976",
    "CVE-2025-48988",
    "CVE-2025-49124",
    "CVE-2025-49125",
    "CVE-2025-55668"
  );
  script_xref(name:"IAVA", value:"2025-A-0437-S");
  script_xref(name:"IAVA", value:"2025-A-0582-S");

  script_name(english:"Apache Tomcat 11.0.0.M1 < 11.0.8 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 11.0.8. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.8_security-11 advisory.

  - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the
    Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache
    Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The
    following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through
    8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or
    9.0.106, which fix the issue. (CVE-2025-49124)

  - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL
    versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106,
    which fix the issue. (CVE-2025-55668)

  - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using
    PreResources or PostResources mounted other than at the root of the web application, it was possible to
    access those resources via an unexpected path. That path was likely not to be protected by the same
    security constraints as the expected path, allowing those security constraints to be bypassed. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1
    through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be
    affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to
    upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49125)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects
    Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through
    9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to
    version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-48988)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in
    Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from
    2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the
    issue. (CVE-2025-48976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/d94bd36fb7eb32e790dae0339bc249069649a637
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d1795b4");
  # https://github.com/apache/tomcat/commit/c56456cda8151c9504dfb7985700824559d769a7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?41b1d4eb");
  # https://github.com/apache/tomcat/commit/2b0ab14fb55d4edc896e5f1817f2ab76f714ae5e
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?400a5e4d");
  # https://github.com/apache/tomcat/commit/74f69ffaf61e54c727603e7e831fe20f0ac5d2a7
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9ecf5d3a");
  # https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.8
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d7f87475");
  # https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d94f144d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 11.0.8 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55668");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-49124");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-48988");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '11.0.0.M1', 'max_version' : '11.0.7', 'fixed_version' : '11.0.8' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);