FKIE_CVE-2019-8993

Vulnerability from fkie_nvd - Published: 2019-04-24 21:29 - Updated: 2024-11-21 04:50
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
References
security@tibco.comhttp://www.securityfocus.com/bid/108056Broken Link, Third Party Advisory, VDB Entry
security@tibco.comhttp://www.tibco.com/services/support/advisoriesVendor Advisory
security@tibco.comhttps://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/108056Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.tibco.com/services/support/advisoriesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993Vendor Advisory
Impacted products
Vendor Product Version
tibco activematrix_bpm *
tibco activematrix_bpm *
tibco activematrix_policy_director *
tibco activematrix_service_bus *
tibco activematrix_service_grid *
tibco activematrix_service_grid *
tibco silver_fabric_enabler *
tibco silver_fabric_enabler *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_bpm:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A533C8A0-3C54-4096-8C29-22E287CB682F",
              "versionEndIncluding": "4.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_bpm:*:*:*:*:*:silver_fabric:*:*",
              "matchCriteriaId": "B01AFA33-D029-48E1-B748-0E828F13F6A7",
              "versionEndIncluding": "4.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_policy_director:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F67910C-AE3D-4A9F-B9E3-617D9EAAFBF7",
              "versionEndIncluding": "1.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_service_bus:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4A41001-9FD6-4821-99C5-56CB1D1C4002",
              "versionEndIncluding": "3.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_service_grid:*:*:*:*:*:silver_fabric:*:*",
              "matchCriteriaId": "1EC19FE2-7EF2-4B67-8AE7-47B4ECFD9A5A",
              "versionEndIncluding": "3.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activematrix_service_grid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBFA5AC6-473A-4FF8-B418-4633DC837E9B",
              "versionEndIncluding": "3.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:silver_fabric_enabler:*:*:*:*:*:activematrix_service_grid:*:*",
              "matchCriteriaId": "52116CC3-1347-4B8E-81F0-D17668D88D10",
              "versionEndIncluding": "1.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:silver_fabric_enabler:*:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "85EFD5DF-F39D-4737-82A4-3E10BBF3EF2C",
              "versionEndIncluding": "1.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The administrative web server component of TIBCO Software Inc.\u0027s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1."
    },
    {
      "lang": "es",
      "value": "El componente de servidor web administrativo de TIBCO Software Inc.TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution para TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution para TIBCO Silver Fabric, TIBCO Silver Fabric Enabler para ActiveMatrix BPM y TIBCO Silver Fabric Enabler para ActiveMatrix Service Grid contienen una vulnerabilidad que te\u00f3ricamente podr\u00eda permitir a un usuario no autenticado descargar un archivo con informaci\u00f3n de credenciales. Las versiones afectadas son TIBCO Software Inc.\u0027s TIBCO ActiveMatrix BPM: versiones hasta 4.2.0 inclusive, TIBCO ActiveMatrix BPM Distribution para TIBCO Silver Fabric: versiones hasta 4.2.0 inclusive, TIBCO ActiveMatrix Policy Director: versiones hasta 1.1.0 inclusive, TIBCO ActiveMatrix Service Bus: versiones hasta 3.3.0 inclusive, TIBCO ActiveMatrix Service Grid: versiones hasta 3.3.1 inclusive, TIBCO ActiveMatrix Service Grid Distribution para TIBCO Silver Fabric: versiones hasta 3.3.0 inclusive, TIBCO Silver Fabric Enabler para ActiveMatrix BPM: versiones hasta 1.4.1 inclusive y TIBCO Silver Fabric Enabler para ActiveMatrix Service Grid: versiones hasta 1.3.1 inclusive."
    }
  ],
  "id": "CVE-2019-8993",
  "lastModified": "2024-11-21T04:50:46.650",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security@tibco.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-04-24T21:29:01.353",
  "references": [
    {
      "source": "security@tibco.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/108056"
    },
    {
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.tibco.com/services/support/advisories"
    },
    {
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/108056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.tibco.com/services/support/advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993"
    }
  ],
  "sourceIdentifier": "security@tibco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.