Apache Tomcat 9.0.0.M1 < 9.0.119 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(323714);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id(
    "CVE-2026-50229",
    "CVE-2026-53404",
    "CVE-2026-53434",
    "CVE-2026-55276",
    "CVE-2026-55955",
    "CVE-2026-55956"
  );

  script_xref(name:"IAVA", value:"2026-A-0642");

  script_name(english:"Apache Tomcat 9.0.0.M1 < 9.0.119 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 9.0.119. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.119_security-9 advisory.

  - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number
    guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from
    10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through
    7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to
    upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue. (CVE-2026-50229)

  - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the
    default servlet ignoring any method or method omission configured as part of the constraint. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached
    end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fix the issue. (CVE-2026-55956)

  - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the
    EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through
    11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from
    7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which
    fixes the issue. (CVE-2026-55955)

  - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and
    empty authorisation constraints were not included when the effective web.xml was logged. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1
    through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be
    affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
    (CVE-2026-55276)

  - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM
    based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through
    10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or
    9.0.119, which fixes the issue. (CVE-2026-53434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/a0374c450970760efafbd8806a1db278830ba7bd
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8005af93");
  # https://github.com/apache/tomcat/commit/6a7a432cd7fb4ef358dc12e8da99cf3ab320f3fe
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c687391");
  # https://github.com/apache/tomcat/commit/3ca8cae5fd3796b1bd9759e11b0e238161e7a39c
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?961654aa");
  # https://github.com/apache/tomcat/commit/c48ac39c27f4494f8c96b9d56a487253e362d276
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62433b2e");
  # https://github.com/apache/tomcat/commit/fe06ae8a71997061596f54189dae1b1b5da75430
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5c21cbfe");
  # https://github.com/apache/tomcat/commit/de5a950415fc67713f17fab63d0c7809e0fca80b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3966cf16");
  # https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.119
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62ccd307");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 9.0.119 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-50229");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-55276");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/30");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:9");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '9.0.0.M1', 'max_version' : '9.0.118', 'fixed_version' : '9.0.119' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING,
    flags:{'xss':TRUE}
);