mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
TIBCO vulnerabilities with the ActiveMatrix Service Grid platform, ActiveMatrix BPM product.
This commit is contained in:
Eric Johnson
parent
f98174c7d3
commit
aa6cc63fa8
@ -1,18 +1,119 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-11203",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11203",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO would like to extend its appreciation to Giulio Comi and Flavio Baldassi of Horizon Security for discovery of these vulnerabilities."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities.\n\nAffected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of this vulnerability includes the theoretical possibility that an unprivileged remote attacker could gain full access to the APIs exposed by the affected ActiveMatrix BPM components."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-11203"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,163 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-8991",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-8991",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO Active Matrix Service Grid Administrator With Multiple Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Policy Director",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Bus",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO would like to extend its appreciation to Giulio Comi and Flavio Baldassi of Horizon Security for discovery of these vulnerabilities."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains multiple vulnerabilities that may allow for cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.\n\nAffected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of these vulnerabilities includes the theoretical possibility that an unprivileged remote attacker could gain full access to all the capabilities of the web interface of the TIBCO ActiveMatrix Administrator."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8991"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO ActiveMatrix Policy Director versions 1.1.0 and below update to version 2.0.0 or higher. Due to the scheduled retirement of this product in early 2021, customers are strongly encouraged to contact TIBCO Support in order to explore alternative paths for remediation.\nTIBCO ActiveMatrix Service Bus versions 3.3.0 and below update to TIBCO ActiveMatrix Service Grid version 3.4.0 or higher (product functionality has been consolidated)\nTIBCO ActiveMatrix Service Grid versions 3.3.1 and below update to version 3.4.0 or higher\nTIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric versions 3.3.0 and below update to version 3.4.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix Service Grid versions 1.3.1 and below update to version 1.3.2 or higher"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,168 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-8992",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-8992",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO Active Matrix Service Grid Administrator Remote Code Execution"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Policy Director",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Bus",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability wherein a user without privileges to upload distributed application archives (\"Upload DAA\" permission) can theoretically upload arbitrary code, and in some circumstances then execute that code on ActiveMatrix Service Grid nodes.\n\nAffected releases are TIBCO Software Inc.'s\n TIBCO ActiveMatrix BPM: versions up to and including 4.2.0,\n TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0,\n TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0,\n TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0,\n TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1,\n TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0,\n TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and\n TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.9,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of this vulnerability includes the theoretical possibility that a user without privileges to upload code could execute arbitrary code on ActiveMatrix Service Grid nodes."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8992"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO ActiveMatrix Policy Director versions 1.1.0 and below update to version 2.0.0 or higher. Due to the scheduled retirement of this product in early 2021, customers are strongly encouraged to contact TIBCO Support in order to explore alternative paths for remediation.\nTIBCO ActiveMatrix Service Bus versions 3.3.0 and below update to TIBCO ActiveMatrix Service Grid version 3.4.0 or higher (product functionality has been consolidated)\nTIBCO ActiveMatrix Service Grid versions 3.3.1 and below update to version 3.4.0 or higher\nTIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric versions 3.3.0 and below update to version 3.4.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix Service Grid versions 1.3.1 and below update to version 1.3.2 or higher\n"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "INTERNAL"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,168 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-8993",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-8993",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Policy Director",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Bus",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "3.3.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information.\n\nAffected releases are TIBCO Software Inc.'s\n TIBCO ActiveMatrix BPM: versions up to and including 4.2.0,\n TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0,\n TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0,\n TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0,\n TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1,\n TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0,\n TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and\n TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 8.6,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of this vulnerability includes the theoretical possibility that credentials could be disclosed."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO ActiveMatrix Policy Director versions 1.1.0 and below update to version 2.0.0 or higher. Due to the scheduled retirement of this product in early 2021, customers are strongly encouraged to contact TIBCO Support in order to explore alternative paths for remediation.\nTIBCO ActiveMatrix Service Bus versions 3.3.0 and below update to TIBCO ActiveMatrix Service Grid version 3.4.0 or higher (product functionality has been consolidated)\nTIBCO ActiveMatrix Service Grid versions 3.3.1 and below update to version 3.4.0 or higher\nTIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric versions 3.3.0 and below update to version 3.4.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix Service Grid versions 1.3.1 and below update to version 1.3.2 or higher\n"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,113 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-8994",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-8994",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO ActiveMatrix BPM Escalation of Privileges Vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The workspace client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contains vulnerabilities where an authenticated user can change settings that can theoretically adversely impact other users.\n\nAffected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of this vulnerability includes the theoretical possibility that an authenticated user could trick other users of the system into visiting malicious web sites."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-8994"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,113 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-8995",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@tibco.com",
|
||||
"DATE_PUBLIC": "2019-04-24T16:00:00.000Z",
|
||||
"ID": "CVE-2019-8995",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "TIBCO ActiveMatrix BPM Open Redirect Vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "4.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TIBCO Silver Fabric Enabler for ActiveMatrix BPM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_value": "1.4.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The workspace client, openspace client, and app development client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain a vulnerability wherein a malicious URL could trick a user into visiting a website of the attacker's choice.\n\nAffected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The impact of this vulnerability includes the theoretical possibility that a user could be tricked into visiting a malicious website."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-activematrix-bpm-2019-8995"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO ActiveMatrix BPM versions 4.2.0 and below update to version 4.3.0 or higher\nTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions 4.2.0 and below update to 4.3.0 or higher\nTIBCO Silver Fabric Enabler for ActiveMatrix BPM versions 1.4.1 and below update to version 1.4.2 or higher"
|
||||
}
|
||||
],
|
||||
"source": {
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user