Vulnerability-Lookup

CNVD-2018-24091

Vulnerability from cnvd - Published: 2018-11-27

Title

TIBCO Rendezvous跨站请求伪造漏洞

Description

TIBCO Rendezvous是美国TIBCO软件公司的一款可帮助用户快速构建和部署大规模分布式应用的中间件产品。 TIBCO Rendezvous中的多个组件（Rendezvous Routing Daemon (rvrd)、Rendezvous Secure Routing Daemon (rvrsd)、Rendezvous Secure Daemon (rvsd)、Rendezvous Cache (rvcache)及Rendezvous Daemon Manager (rvdm)）存在跨站请求伪造漏洞。攻击者可利用该漏洞重新配置所有消息。

Severity

高

Patch Name

TIBCO Rendezvous跨站请求伪造漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous

Reference

https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous

Impacted products

Name
['TIBCO Rendezvous <=8.4.5', 'TIBCO Rendezvous Developer Edition <=8.4.5', 'TIBCO Rendezvous for z/Linux versions <=8.4.5', 'TIBCO Rendezvous for z/OS <=8.4.5', 'TIBCO Rendezvous Network Server <=1.1.2', 'TIBCO Substation ES versions <=2.12.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105871"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-12414"
    }
  },
  "description": "TIBCO Rendezvous\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4e00\u6b3e\u53ef\u5e2e\u52a9\u7528\u6237\u5feb\u901f\u6784\u5efa\u548c\u90e8\u7f72\u5927\u89c4\u6a21\u5206\u5e03\u5f0f\u5e94\u7528\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u3002\n\nTIBCO Rendezvous\u4e2d\u7684\u591a\u4e2a\u7ec4\u4ef6\uff08Rendezvous Routing Daemon (rvrd)\u3001Rendezvous Secure Routing Daemon (rvrsd)\u3001Rendezvous Secure Daemon (rvsd)\u3001Rendezvous Cache (rvcache)\u53caRendezvous Daemon Manager (rvdm)\uff09\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u91cd\u65b0\u914d\u7f6e\u6240\u6709\u6d88\u606f\u3002",
  "discovererName": "TIBCO",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24091",
  "openTime": "2018-11-27",
  "patchDescription": "TIBCO Rendezvous\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4e00\u6b3e\u53ef\u5e2e\u52a9\u7528\u6237\u5feb\u901f\u6784\u5efa\u548c\u90e8\u7f72\u5927\u89c4\u6a21\u5206\u5e03\u5f0f\u5e94\u7528\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u3002\r\n\r\nTIBCO Rendezvous\u4e2d\u7684\u591a\u4e2a\u7ec4\u4ef6\uff08Rendezvous Routing Daemon (rvrd)\u3001Rendezvous Secure Routing Daemon (rvrsd)\u3001Rendezvous Secure Daemon (rvsd)\u3001Rendezvous Cache (rvcache)\u53caRendezvous Daemon Manager (rvdm)\uff09\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u91cd\u65b0\u914d\u7f6e\u6240\u6709\u6d88\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "TIBCO Rendezvous\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "TIBCO Rendezvous \u003c=8.4.5",
      "TIBCO Rendezvous Developer Edition \u003c=8.4.5",
      "TIBCO Rendezvous for z/Linux versions \u003c=8.4.5",
      "TIBCO Rendezvous for z/OS \u003c=8.4.5",
      "TIBCO Rendezvous Network Server \u003c=1.1.2",
      "TIBCO Substation ES versions \u003c=2.12.0"
    ]
  },
  "referenceLink": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-08",
  "title": "TIBCO Rendezvous\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2018-12414 (GCVE-0-2018-12414)

Vulnerability from cvelistv5 – Published: 2018-11-07 00:00 – Updated: 2024-09-16 21:04

Title

TIBCO Rendezvous Vulnerable to CSRF Attacks

Summary

The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV.

Assigner

tibco mitre root Scorecard

References

3 references

URL	Tags
http://www.securityfocus.com/bid/105871	vdb-entryx_refsource_BID
http://www.tibco.com/services/support/advisories	x_refsource_MISC
https://www.tibco.com/support/advisories/2018/11/…	x_refsource_CONFIRM

Impacted products

6 products

Vendor	Product	Version
TIBCO Software Inc.	TIBCO Rendezvous	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous Developer Edition	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous for z/Linux	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous for z/OS	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous Network Server	Affected: unspecified , ≤ 1.1.2 (custom)
TIBCO Software Inc.	TIBCO Substation ES	Affected: unspecified , ≤ 2.12.2 (custom)

Date Public

2018-11-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:05.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105871",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105871"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.tibco.com/services/support/advisories"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO Rendezvous",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous Developer Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous for z/Linux",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous for z/OS",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous Network Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.1.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Substation ES",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2.12.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.\u0027s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.\u0027s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-10T10:57:02.000Z",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "name": "105871",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105871"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.tibco.com/services/support/advisories"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO Rendezvous versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Developer Edition versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/Linux versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/OS versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Network Server versions 1.1.2 and below update to version 1.1.3 or higher\nTIBCO Substation ES versions 2.12.0 and below update to version 2.12.1 or higher"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO Rendezvous Vulnerable to CSRF Attacks",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2018-11-06T17:00:00.000Z",
          "ID": "CVE-2018-12414",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO Rendezvous Vulnerable to CSRF Attacks"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO Rendezvous",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous Developer Edition",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous for z/Linux",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous for z/OS",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous Network Server",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "1.1.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Substation ES",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "2.12.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.\u0027s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.\u0027s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105871",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105871"
            },
            {
              "name": "http://www.tibco.com/services/support/advisories",
              "refsource": "MISC",
              "url": "http://www.tibco.com/services/support/advisories"
            },
            {
              "name": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO Rendezvous versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Developer Edition versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/Linux versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/OS versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Network Server versions 1.1.2 and below update to version 1.1.3 or higher\nTIBCO Substation ES versions 2.12.0 and below update to version 2.12.1 or higher"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2018-12414",
    "datePublished": "2018-11-07T00:00:00.000Z",
    "dateReserved": "2018-06-14T00:00:00.000Z",
    "dateUpdated": "2024-09-16T21:04:22.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2018-24091

CVE-2018-12414 (GCVE-0-2018-12414)

Tags

Sightings

Nomenclature

Related by attack behaviour