Search criteria
15 vulnerabilities found for eftl by tibco
FKIE_CVE-2022-30574
Vulnerability from fkie_nvd - Published: 2022-08-09 18:15 - Updated: 2024-11-21 07:02
Severity ?
4.6 (Medium) - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "C70CD63C-4E67-4067-BE61-A3F0F20B2FF7",
"versionEndIncluding": "6.7.3",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:*",
"matchCriteriaId": "E763FF1F-EA73-42AB-A975-0CE765265662",
"versionEndIncluding": "6.8.0",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:*",
"matchCriteriaId": "91D694DE-7F31-4CBC-9A17-E16DD136979E",
"versionEndIncluding": "6.8.0",
"versionStartIncluding": "6.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.8.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "68E1EA1B-8795-4E53-A2BB-39162B53A1D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "7D485C5C-43DF-4CF1-B9C8-EC233DE33A1E",
"versionEndIncluding": "6.7.3",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*",
"matchCriteriaId": "69A74216-7BA6-4188-84FD-831E819A24F1",
"versionEndIncluding": "6.8.0",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*",
"matchCriteriaId": "902741F5-B8C3-4894-AD32-353060446519",
"versionEndIncluding": "6.8.0",
"versionStartIncluding": "6.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.8.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "12DBFB38-76C5-43B1-9927-C970B782A670",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ftlserver component of TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0."
},
{
"lang": "es",
"value": "El componente ftlserver de TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, y TIBCO eFTL - Enterprise Edition contiene una vulnerabilidad dif\u00edcil de explotar que permite a un atacante poco privilegiado y acceso local obtener las credenciales de usuario del sistema afectado. Las versiones afectadas son TIBCO FTL - Community Edition de TIBCO Software Inc.: versiones 6.0.0 hasta 6.8.0, TIBCO FTL - Developer Edition: versiones 6.0.1 hasta 6.8.0, TIBCO FTL - Enterprise Edition: versiones 6.0.0 hasta 6.7.3, TIBCO FTL - Enterprise Edition: versi\u00f3n 6. 8.0, TIBCO eFTL - Community Edition: versiones 6.0.0 hasta 6.8.0, TIBCO eFTL - Developer Edition: versiones 6.0.1 hasta 6.8.0, TIBCO eFTL - Enterprise Edition: versiones 6.0.0 hasta 6.7.3, y TIBCO eFTL - Enterprise Edition: versi\u00f3n 6.8.0"
}
],
"id": "CVE-2022-30574",
"lastModified": "2024-11-21T07:02:57.573",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 3.4,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-08-09T18:15:08.367",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-43055
Vulnerability from fkie_nvd - Published: 2022-01-11 19:15 - Updated: 2024-11-21 06:28
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*",
"matchCriteriaId": "03ACBE3F-6FC8-4F79-9B26-80BBDDACF24E",
"versionEndIncluding": "6.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*",
"matchCriteriaId": "8AA36B2D-C7B9-4866-A350-6C251E662BF7",
"versionEndIncluding": "6.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CF0E1715-61DB-4B7B-9B31-5363005DCB0C",
"versionEndIncluding": "6.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
},
{
"lang": "es",
"value": "El componente eFTL Server de TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, y TIBCO eFTL - Enterprise Edition contiene una vulnerabilidad f\u00e1cilmente explotable que permite a los clientes heredar los permisos del cliente que fue conectado inicialmente en el sistema afectado. Las versiones afectadas son TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versiones 6.7.2 y anteriores, TIBCO eFTL - Developer Edition: versiones 6.7.2 y anteriores, y TIBCO eFTL - Enterprise Edition: versiones 6.7.2 y anteriores"
}
],
"id": "CVE-2021-43055",
"lastModified": "2024-11-21T06:28:36.537",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 4.2,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-11T19:15:08.037",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-43054
Vulnerability from fkie_nvd - Published: 2022-01-11 19:15 - Updated: 2024-11-21 06:28
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*",
"matchCriteriaId": "03ACBE3F-6FC8-4F79-9B26-80BBDDACF24E",
"versionEndIncluding": "6.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*",
"matchCriteriaId": "8AA36B2D-C7B9-4866-A350-6C251E662BF7",
"versionEndIncluding": "6.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CF0E1715-61DB-4B7B-9B31-5363005DCB0C",
"versionEndIncluding": "6.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
},
{
"lang": "es",
"value": "El componente eFTL Server de TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, y TIBCO eFTL - Enterprise Edition contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante con pocos privilegios y acceso a la red generar tokens de API que pueden acceder a cualquier otro canal con permisos arbitrarios. Las versiones afectadas son TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versiones 6.7.2 y anteriores, TIBCO eFTL - Developer Edition: versiones 6.7.2 y anteriores, y TIBCO eFTL - Enterprise Edition: versiones 6.7.2 y anteriores"
}
],
"id": "CVE-2021-43054",
"lastModified": "2024-11-21T06:28:36.400",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.2,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-11T19:15:07.987",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-35497
Vulnerability from fkie_nvd - Published: 2021-10-05 18:15 - Updated: 2024-11-21 06:12
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:community:*:*:*",
"matchCriteriaId": "D629C1A4-DB9E-4B2C-9A78-E4608DF20402",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "BEEE3367-C78C-4D1D-959F-28F2ED4A7548",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "5C5F9EFC-671A-49F1-92AC-86A5760D72BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:community:*:*:*",
"matchCriteriaId": "E56A1CF8-3907-48DB-81CC-5C7E13D80F9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "0E667C4C-A147-4BA5-A04E-9235AA038F17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "57C92318-24AB-42A1-8F27-2552496F5962",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:community:*:*:*",
"matchCriteriaId": "5C4CFCEF-DFA6-4CF7-B2A3-961477917E6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "D60BB933-EAE7-4C5E-8210-1494F2367D36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "0C076170-90C8-4872-BDC9-3212642177B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:community:*:*:*",
"matchCriteriaId": "4E7D8BF1-8D74-41E1-A853-F6E848E1F98C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "0C77F3A3-2C47-4B45-86B8-D5F050AB2BF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "B5DEDA14-4027-432C-B98C-108E0EC22BAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:community:*:*:*",
"matchCriteriaId": "51841D47-A6C0-4029-8BD5-791C6379D864",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:developer:*:*:*",
"matchCriteriaId": "029C9F40-0FD8-47D9-906A-0E9C46024C69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "F3205BA1-5F31-4003-AC6C-12EE154F9413",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:community:*:*:*",
"matchCriteriaId": "D06EE4F3-496A-4246-A127-AE4E14AE6B87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:developer:*:*:*",
"matchCriteriaId": "DBFC3DDF-8D8B-4165-A574-82DA436FBE77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "8F632248-028D-4233-8FD2-0F6B8247E2EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:community:*:*:*",
"matchCriteriaId": "84E7868B-5BE6-4BE2-A34F-8B93DEAD00DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "B17407F4-2F7B-4A0F-9EF3-5266A4151371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "ACF6B615-FF32-429D-9AE9-3F761385B0F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:community:*:*:*",
"matchCriteriaId": "FAAF3359-80A0-4603-9F46-985EF3F7783D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "7A8BD048-0D83-4820-97CF-E17E14558E26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "E9A9B854-3145-4D75-8CB8-13A7691212A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:community:*:*:*",
"matchCriteriaId": "9027C05A-C291-4E6C-A837-634EA3527383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:developer:*:*:*",
"matchCriteriaId": "7EC71AE7-6E51-4D69-A813-8A5FA8426612",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A7AC8D4C-EBE3-43B7-9145-96363727597C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:community:*:*:*",
"matchCriteriaId": "8F6A77B5-510C-44AE-8774-1A3E7C2AF461",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "5A843829-0AC4-4F7B-8CE2-1D6A5EAE577D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "82FC3703-BFAD-423F-A58F-1990F948D673",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:community:*:*:*",
"matchCriteriaId": "15619E54-5711-47B9-B7EB-BA028CDFE301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "7AB09709-3AB7-40DE-9E8F-412673DA828D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "1738BA42-E260-44A1-B885-EB7108B205FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:community:*:*:*",
"matchCriteriaId": "766D725D-85E2-48D9-B225-185E383D87F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "4B78899C-F97D-4679-99ED-C2414B82D0D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "254CC54E-2E20-4C71-8A1C-92AD2C226479",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:community:*:*:*",
"matchCriteriaId": "C7BC3BE1-CD23-4003-84FA-D03940430DF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:developer:*:*:*",
"matchCriteriaId": "C5688C44-05E0-4927-A26E-235CFF7EAF04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "308EB3E3-7534-47B2-822B-98ED3911E6A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:community:*:*:*",
"matchCriteriaId": "239AC202-82E0-4C26-A0FB-4A8435FCD5D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "E978B111-02A6-4167-9F56-89E9A30CF7C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "E950DD67-B799-4A46-97CD-E5B69494E92E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:community:*:*:*",
"matchCriteriaId": "38E8B639-69C2-442D-9D24-74BBC77E2559",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "0955AFA2-947E-4D8E-89AB-F2C61236EAA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "8A25520E-8099-448C-85A2-A1FE41BB0BF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:community:*:*:*",
"matchCriteriaId": "10AB5782-E640-4064-8598-D83CFC11F7E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "A0A3C5BB-F5C3-4C6B-ADD2-9F1113B7E9C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "9F2E4929-E11A-4A7E-8CFD-E268D26D91FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:community:*:*:*",
"matchCriteriaId": "D795CEDE-E585-43BE-84C3-B6D87F14B1FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:developer:*:*:*",
"matchCriteriaId": "C874D773-AC4B-467A-B2CF-4C3B3171F8FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "5DD8A9EB-D773-4354-9801-AAA42B9C3093",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:community:*:*:*",
"matchCriteriaId": "A8567FF5-D0E3-43B8-B86F-6FCD742E66D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "891D9445-A932-48C2-8CEF-51E0D07F5583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "95C9E7BD-0BD4-467D-A51E-E918B70F1250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:community:*:*:*",
"matchCriteriaId": "A5327841-C2DF-4971-A9EB-6427ECF2CDDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "F376D569-8B82-4988-900F-FAF8F8B48D22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "BFF3AFB8-4D7E-4036-A910-E7508E1FE74E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:community:*:*:*",
"matchCriteriaId": "1CC754F5-E59C-40C6-8C1D-C138FA652225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "BF79A77E-72C1-4855-89F5-DA3E603A338C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "0B5EEF4E-C78A-46F3-8C5C-1B4BE853535B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:community:*:*:*",
"matchCriteriaId": "0860A10B-E692-4FFC-A501-7F224099B9CC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:developer:*:*:*",
"matchCriteriaId": "53A7A5B7-D065-4D7F-B7F0-577CE624EBA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "B25D0767-BD16-4536-8D4F-3F6F1998DEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:community:*:*:*",
"matchCriteriaId": "5CA76F30-C882-4AA6-9221-66757C60668C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:developer:*:*:*",
"matchCriteriaId": "EC817235-C135-48C5-92EB-2F0F23F712E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "54DB5EFD-5F7E-47FB-AD43-B4C98E1295DF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
},
{
"lang": "es",
"value": "El servidor FTL (tibftlserver) y las im\u00e1genes Docker que contienen los componentes tibftlserver de TIBCO Software Inc. TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, y TIBCO eFTL - Enterprise Edition. contienen una vulnerabilidad que te\u00f3ricamente permite a un usuario de FTL no administrativo y autenticado enga\u00f1ar a los componentes afectados para que creen certificados ileg\u00edtimos. Estos certificados generados de forma maliciosa pueden ser usados para habilitar ataques de tipo man-in-the-middle o para escalar privilegios de forma que el usuario malicioso tenga privilegios administrativos. Las versiones afectadas son TIBCO ActiveSpaces - Community Edition de TIBCO Software Inc.: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6.2, TIBCO ActiveSpaces - Developer Edition: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6. 2, TIBCO ActiveSpaces - Enterprise Edition: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6.2, TIBCO FTL - Community Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO FTL - Developer Edition: versiones 6. 2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO FTL - Enterprise Edition: versiones 6.2.0, 6.3.0, 6. 3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO eFTL - Community Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5. 0, 6.6.0, 6.6.1 y 6.7.0, TIBCO eFTL - Developer Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6. 1 y 6.7.0, y TIBCO eFTL - Enterprise Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0"
}
],
"id": "CVE-2021-35497",
"lastModified": "2024-11-21T06:12:23.117",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-10-05T18:15:07.690",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-295"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-28823
Vulnerability from fkie_nvd - Published: 2021-03-23 21:15 - Updated: 2024-11-21 06:00
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below.
References
| URL | Tags | ||
|---|---|---|---|
| security@tibco.com | http://www.tibco.com/services/support/advisories | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.tibco.com/services/support/advisories | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*",
"matchCriteriaId": "FCA4319C-1790-426D-96D8-8BA8DF72DBC2",
"versionEndExcluding": "6.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*",
"matchCriteriaId": "6E4A78A7-5FAE-4B70-8EC5-3D409B833D72",
"versionEndExcluding": "6.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CB170CBF-8BA5-45D1-B540-BD124AD8E32C",
"versionEndExcluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."
},
{
"lang": "es",
"value": "El componente de instalaci\u00f3n de Windows de TIBCO eFTL - Community Edition de TIBCO Software Inc., TIBCO eFTL - Developer Edition y TIBCO eFTL - Enterprise Edition, contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante poco privilegiado con acceso local en algunas versiones del sistema operativo Windows insertar software malicioso.\u0026#xa0;Se puede abusar del componente afectado para ejecutar el software malicioso insertado por el atacante con los privilegios elevados del componente.\u0026#xa0;Esta vulnerabilidad es debido a una falta de restricciones de acceso a determinados archivos y/o carpetas en la instalaci\u00f3n.\u0026#xa0;Las versiones afectadas son TIBCO eFTL - Community Edition de TIBCO Software Inc.: versiones 6.5.0 y por debajo, TIBCO eFTL - Developer Edition: versiones 6.5.0 y por debajo, y TIBCO eFTL - Enterprise Edition: versiones 6.5.0 y por debajo"
}
],
"id": "CVE-2021-28823",
"lastModified": "2024-11-21T06:00:16.340",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-03-23T21:15:14.180",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2022-30574 (GCVE-0-2022-30574)
Vulnerability from cvelistv5 – Published: 2022-08-09 17:20 – Updated: 2024-09-16 18:49
VLAI?
Title
TIBCO eFTL Secret Jacking
Summary
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0.
Severity ?
4.6 (Medium)
CWE
- Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO FTL - Community Edition |
Affected:
unspecified , ≤ 6.8.0
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:56:12.980Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO FTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.8.0"
}
]
},
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.8.0"
}
]
}
],
"datePublic": "2022-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The ftlserver component of TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-09T18:07:11",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO eFTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"
}
],
"title": "TIBCO eFTL Secret Jacking",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-08-09T17:00:00Z",
"ID": "CVE-2022-30574",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Secret Jacking"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO FTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.3"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.3"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.8.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The ftlserver component of TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO eFTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"
}
],
"source": {
"discovery": ""
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-30574",
"datePublished": "2022-08-09T17:20:16.285207Z",
"dateReserved": "2022-05-11T00:00:00",
"dateUpdated": "2024-09-16T18:49:54.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43055 (GCVE-0-2021-43055)
Vulnerability from cvelistv5 – Published: 2022-01-11 18:25 – Updated: 2024-09-16 20:03
VLAI?
Title
TIBCO eFTL Token Caching Vulnerability
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Severity ?
5.9 (Medium)
CWE
- Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.7.2
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.230Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-01-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-11T19:06:22",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO eFTL Token Caching Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-01-11T17:00:00Z",
"ID": "CVE-2021-43055",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Token Caching Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43055",
"datePublished": "2022-01-11T18:25:28.892632Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-16T20:03:47.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43054 (GCVE-0-2021-43054)
Vulnerability from cvelistv5 – Published: 2022-01-11 18:25 – Updated: 2024-09-17 02:11
VLAI?
Title
TIBCO eFTL Token Generation Vulnerability
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Severity ?
7.1 (High)
CWE
- Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.7.2
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-01-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-11T19:06:18",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO eFTL Token Generation Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-01-11T17:00:00Z",
"ID": "CVE-2021-43054",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Token Generation Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43054",
"datePublished": "2022-01-11T18:25:27.550089Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-17T02:11:55.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35497 (GCVE-0-2021-35497)
Vulnerability from cvelistv5 – Published: 2021-10-05 17:25 – Updated: 2024-09-16 23:51
VLAI?
Title
TIBCO FTL unvalidated SAN in client certificates
Summary
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
Severity ?
7.5 (High)
CWE
- The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO ActiveSpaces - Community Edition |
Affected:
4.3.0
Affected: 4.4.0 Affected: 4.5.0 Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:40:47.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO ActiveSpaces - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO ActiveSpaces - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO ActiveSpaces - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO FTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO FTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
}
],
"datePublic": "2021-10-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-10T21:20:08",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Developer Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Enterprise Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO FTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO FTL unvalidated SAN in client certificates",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-10-05T17:00:00Z",
"ID": "CVE-2021-35497",
"STATE": "PUBLIC",
"TITLE": "TIBCO FTL unvalidated SAN in client certificates",
"UPDATED": "2022-03-10T21:00:00Z"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO ActiveSpaces - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO ActiveSpaces - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO ActiveSpaces - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO FTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Developer Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Enterprise Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO FTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-35497",
"datePublished": "2021-10-05T17:25:10.057412Z",
"dateReserved": "2021-06-24T00:00:00",
"dateUpdated": "2024-09-16T23:51:00.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28823 (GCVE-0-2021-28823)
Vulnerability from cvelistv5 – Published: 2021-03-23 20:15 – Updated: 2024-09-16 18:08
VLAI?
Title
TIBCO eFTL Windows Platform Installation vulnerability
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.5.0
(custom)
|
||||||||||||
|
||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.579Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-03-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-23T20:15:25",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Developer Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Enterprise Edition versions 6.5.0 and below update to version 6.6.0 or higher"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO eFTL Windows Platform Installation vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-03-23T17:00:00Z",
"ID": "CVE-2021-28823",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Windows Platform Installation vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Developer Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Enterprise Edition versions 6.5.0 and below update to version 6.6.0 or higher"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-28823",
"datePublished": "2021-03-23T20:15:25.554890Z",
"dateReserved": "2021-03-18T00:00:00",
"dateUpdated": "2024-09-16T18:08:48.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-30574 (GCVE-0-2022-30574)
Vulnerability from nvd – Published: 2022-08-09 17:20 – Updated: 2024-09-16 18:49
VLAI?
Title
TIBCO eFTL Secret Jacking
Summary
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0.
Severity ?
4.6 (Medium)
CWE
- Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO FTL - Community Edition |
Affected:
unspecified , ≤ 6.8.0
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:56:12.980Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO FTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.8.0"
}
]
},
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.8.0"
}
]
}
],
"datePublic": "2022-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The ftlserver component of TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-09T18:07:11",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO eFTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"
}
],
"title": "TIBCO eFTL Secret Jacking",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-08-09T17:00:00Z",
"ID": "CVE-2022-30574",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Secret Jacking"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO FTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.3"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.8.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.3"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.8.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The ftlserver component of TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30574"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO eFTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"
}
],
"source": {
"discovery": ""
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-30574",
"datePublished": "2022-08-09T17:20:16.285207Z",
"dateReserved": "2022-05-11T00:00:00",
"dateUpdated": "2024-09-16T18:49:54.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43055 (GCVE-0-2021-43055)
Vulnerability from nvd – Published: 2022-01-11 18:25 – Updated: 2024-09-16 20:03
VLAI?
Title
TIBCO eFTL Token Caching Vulnerability
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Severity ?
5.9 (Medium)
CWE
- Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.7.2
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.230Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-01-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-11T19:06:22",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO eFTL Token Caching Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-01-11T17:00:00Z",
"ID": "CVE-2021-43055",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Token Caching Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43055",
"datePublished": "2022-01-11T18:25:28.892632Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-16T20:03:47.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43054 (GCVE-0-2021-43054)
Vulnerability from nvd – Published: 2022-01-11 18:25 – Updated: 2024-09-17 02:11
VLAI?
Title
TIBCO eFTL Token Generation Vulnerability
Summary
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Severity ?
7.1 (High)
CWE
- Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.7.2
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.223Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.7.2",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2022-01-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-11T19:06:18",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO eFTL Token Generation Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-01-11T17:00:00Z",
"ID": "CVE-2021-43054",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Token Generation Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.7.2"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The eFTL Server component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later\nTIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43054",
"datePublished": "2022-01-11T18:25:27.550089Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-17T02:11:55.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-35497 (GCVE-0-2021-35497)
Vulnerability from nvd – Published: 2021-10-05 17:25 – Updated: 2024-09-16 23:51
VLAI?
Title
TIBCO FTL unvalidated SAN in client certificates
Summary
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
Severity ?
7.5 (High)
CWE
- The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO ActiveSpaces - Community Edition |
Affected:
4.3.0
Affected: 4.4.0 Affected: 4.5.0 Affected: 4.6.0 Affected: 4.6.1 Affected: 4.6.2 |
||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T00:40:47.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO ActiveSpaces - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO ActiveSpaces - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO ActiveSpaces - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "4.3.0"
},
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.6.0"
},
{
"status": "affected",
"version": "4.6.1"
},
{
"status": "affected",
"version": "4.6.2"
}
]
},
{
"product": "TIBCO FTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO FTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO FTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.3.0"
},
{
"status": "affected",
"version": "6.3.1"
},
{
"status": "affected",
"version": "6.4.0"
},
{
"status": "affected",
"version": "6.5.0"
},
{
"status": "affected",
"version": "6.6.0"
},
{
"status": "affected",
"version": "6.6.1"
},
{
"status": "affected",
"version": "6.7.0"
}
]
}
],
"datePublic": "2021-10-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-03-10T21:20:08",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Developer Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Enterprise Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO FTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO FTL unvalidated SAN in client certificates",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-10-05T17:00:00Z",
"ID": "CVE-2021-35497",
"STATE": "PUBLIC",
"TITLE": "TIBCO FTL unvalidated SAN in client certificates",
"UPDATED": "2022-03-10T21:00:00Z"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO ActiveSpaces - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO ActiveSpaces - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO ActiveSpaces - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "4.3.0"
},
{
"version_affected": "=",
"version_value": "4.4.0"
},
{
"version_affected": "=",
"version_value": "4.5.0"
},
{
"version_affected": "=",
"version_value": "4.6.0"
},
{
"version_affected": "=",
"version_value": "4.6.1"
},
{
"version_affected": "=",
"version_value": "4.6.2"
}
]
}
},
{
"product_name": "TIBCO FTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO FTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.2.0"
},
{
"version_affected": "=",
"version_value": "6.3.0"
},
{
"version_affected": "=",
"version_value": "6.3.1"
},
{
"version_affected": "=",
"version_value": "6.4.0"
},
{
"version_affected": "=",
"version_value": "6.5.0"
},
{
"version_affected": "=",
"version_value": "6.6.0"
},
{
"version_affected": "=",
"version_value": "6.6.1"
},
{
"version_affected": "=",
"version_value": "6.7.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Developer Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO ActiveSpaces - Enterprise Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later\nTIBCO FTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO FTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later\nTIBCO eFTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-35497",
"datePublished": "2021-10-05T17:25:10.057412Z",
"dateReserved": "2021-06-24T00:00:00",
"dateUpdated": "2024-09-16T23:51:00.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28823 (GCVE-0-2021-28823)
Vulnerability from nvd – Published: 2021-03-23 20:15 – Updated: 2024-09-16 18:08
VLAI?
Title
TIBCO eFTL Windows Platform Installation vulnerability
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO eFTL - Community Edition |
Affected:
unspecified , ≤ 6.5.0
(custom)
|
||||||||||||
|
||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.579Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO eFTL - Community Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Developer Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO eFTL - Enterprise Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "6.5.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-03-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-23T20:15:25",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Developer Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Enterprise Edition versions 6.5.0 and below update to version 6.6.0 or higher"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO eFTL Windows Platform Installation vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-03-23T17:00:00Z",
"ID": "CVE-2021-28823",
"STATE": "PUBLIC",
"TITLE": "TIBCO eFTL Windows Platform Installation vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO eFTL - Community Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Developer Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
},
{
"product_name": "TIBCO eFTL - Enterprise Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "6.5.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO eFTL - Community Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Developer Edition versions 6.5.0 and below update to version 6.6.0 or higher\nTIBCO eFTL - Enterprise Edition versions 6.5.0 and below update to version 6.6.0 or higher"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-28823",
"datePublished": "2021-03-23T20:15:25.554890Z",
"dateReserved": "2021-03-18T00:00:00",
"dateUpdated": "2024-09-16T18:08:48.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}