cnvd - cnvd-2018-24091

CNVD-2018-24091

Vulnerability from cnvd - Published: 2018-11-27

Title

TIBCO Rendezvous跨站请求伪造漏洞

Description

TIBCO Rendezvous是美国TIBCO软件公司的一款可帮助用户快速构建和部署大规模分布式应用的中间件产品。 TIBCO Rendezvous中的多个组件（Rendezvous Routing Daemon (rvrd)、Rendezvous Secure Routing Daemon (rvrsd)、Rendezvous Secure Daemon (rvsd)、Rendezvous Cache (rvcache)及Rendezvous Daemon Manager (rvdm)）存在跨站请求伪造漏洞。攻击者可利用该漏洞重新配置所有消息。

Severity

高

Patch Name

TIBCO Rendezvous跨站请求伪造漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous

Reference

https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous

Impacted products

Name
['TIBCO Rendezvous <=8.4.5', 'TIBCO Rendezvous Developer Edition <=8.4.5', 'TIBCO Rendezvous for z/Linux versions <=8.4.5', 'TIBCO Rendezvous for z/OS <=8.4.5', 'TIBCO Rendezvous Network Server <=1.1.2', 'TIBCO Substation ES versions <=2.12.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105871"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-12414"
    }
  },
  "description": "TIBCO Rendezvous\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4e00\u6b3e\u53ef\u5e2e\u52a9\u7528\u6237\u5feb\u901f\u6784\u5efa\u548c\u90e8\u7f72\u5927\u89c4\u6a21\u5206\u5e03\u5f0f\u5e94\u7528\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u3002\n\nTIBCO Rendezvous\u4e2d\u7684\u591a\u4e2a\u7ec4\u4ef6\uff08Rendezvous Routing Daemon (rvrd)\u3001Rendezvous Secure Routing Daemon (rvrsd)\u3001Rendezvous Secure Daemon (rvsd)\u3001Rendezvous Cache (rvcache)\u53caRendezvous Daemon Manager (rvdm)\uff09\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u91cd\u65b0\u914d\u7f6e\u6240\u6709\u6d88\u606f\u3002",
  "discovererName": "TIBCO",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24091",
  "openTime": "2018-11-27",
  "patchDescription": "TIBCO Rendezvous\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4e00\u6b3e\u53ef\u5e2e\u52a9\u7528\u6237\u5feb\u901f\u6784\u5efa\u548c\u90e8\u7f72\u5927\u89c4\u6a21\u5206\u5e03\u5f0f\u5e94\u7528\u7684\u4e2d\u95f4\u4ef6\u4ea7\u54c1\u3002\r\n\r\nTIBCO Rendezvous\u4e2d\u7684\u591a\u4e2a\u7ec4\u4ef6\uff08Rendezvous Routing Daemon (rvrd)\u3001Rendezvous Secure Routing Daemon (rvrsd)\u3001Rendezvous Secure Daemon (rvsd)\u3001Rendezvous Cache (rvcache)\u53caRendezvous Daemon Manager (rvdm)\uff09\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u91cd\u65b0\u914d\u7f6e\u6240\u6709\u6d88\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "TIBCO Rendezvous\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "TIBCO Rendezvous \u003c=8.4.5",
      "TIBCO Rendezvous Developer Edition \u003c=8.4.5",
      "TIBCO Rendezvous for z/Linux versions \u003c=8.4.5",
      "TIBCO Rendezvous for z/OS \u003c=8.4.5",
      "TIBCO Rendezvous Network Server \u003c=1.1.2",
      "TIBCO Substation ES versions \u003c=2.12.0"
    ]
  },
  "referenceLink": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-08",
  "title": "TIBCO Rendezvous\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e"
}

CVE-2018-12414 (GCVE-0-2018-12414)

Vulnerability from cvelistv5 – Published: 2018-11-07 00:00 – Updated: 2024-09-16 21:04

Title

TIBCO Rendezvous Vulnerable to CSRF Attacks

Summary

The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2.

Severity ?

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV.

Assigner

tibco

References

URL

Tags

	http://www.securityfocus.com/bid/105871	vdb-entryx_refsource_BID
	http://www.tibco.com/services/support/advisories	x_refsource_MISC
	https://www.tibco.com/support/advisories/2018/11/…	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

TIBCO Software Inc.

TIBCO Rendezvous

Affected: unspecified , ≤ 8.4.5 (custom)

TIBCO Software Inc.	TIBCO Rendezvous Developer Edition	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous for z/Linux	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous for z/OS	Affected: unspecified , ≤ 8.4.5 (custom)
TIBCO Software Inc.	TIBCO Rendezvous Network Server	Affected: unspecified , ≤ 1.1.2 (custom)
TIBCO Software Inc.	TIBCO Substation ES	Affected: unspecified , ≤ 2.12.2 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:38:05.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105871",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105871"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.tibco.com/services/support/advisories"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO Rendezvous",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous Developer Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous for z/Linux",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous for z/OS",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.4.5",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Rendezvous Network Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.1.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Substation ES",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2.12.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-11-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.\u0027s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.\u0027s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-10T10:57:02",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "name": "105871",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105871"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.tibco.com/services/support/advisories"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO Rendezvous versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Developer Edition versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/Linux versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/OS versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Network Server versions 1.1.2 and below update to version 1.1.3 or higher\nTIBCO Substation ES versions 2.12.0 and below update to version 2.12.1 or higher"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO Rendezvous Vulnerable to CSRF Attacks",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2018-11-06T17:00:00.000Z",
          "ID": "CVE-2018-12414",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO Rendezvous Vulnerable to CSRF Attacks"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO Rendezvous",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous Developer Edition",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous for z/Linux",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous for z/OS",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "8.4.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Rendezvous Network Server",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "1.1.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Substation ES",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c=",
                            "version_affected": "\u003c=",
                            "version_value": "2.12.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.\u0027s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.\u0027s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "The impact of these vulnerabilities includes the theoretical possibility of reconfiguring all messaging handled by TIBCO Rendezvous (RV). With such access, the attacker might also be able to gain access to all data sent via RV."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105871",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105871"
            },
            {
              "name": "http://www.tibco.com/services/support/advisories",
              "refsource": "MISC",
              "url": "http://www.tibco.com/services/support/advisories"
            },
            {
              "name": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO Rendezvous versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Developer Edition versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/Linux versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous for z/OS versions 8.4.5 and below update to version 8.4.6 or higher\nTIBCO Rendezvous Network Server versions 1.1.2 and below update to version 1.1.3 or higher\nTIBCO Substation ES versions 2.12.0 and below update to version 2.12.1 or higher"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2018-12414",
    "datePublished": "2018-11-07T00:00:00Z",
    "dateReserved": "2018-06-14T00:00:00",
    "dateUpdated": "2024-09-16T21:04:22.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-24091

CVE-2018-12414 (GCVE-0-2018-12414)

Tags

Sightings

Nomenclature