FKIE_CVE-2021-35497

Vulnerability from fkie_nvd - Published: 2021-10-05 18:15 - Updated: 2024-11-21 06:12
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
References
security@tibco.comhttps://www.tibco.com/services/support/advisoriesVendor Advisory
security@tibco.comhttps://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tibco.com/services/support/advisoriesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497Vendor Advisory
Impacted products
Vendor Product Version
tibco activespaces 4.3.0
tibco activespaces 4.3.0
tibco activespaces 4.3.0
tibco activespaces 4.4.0
tibco activespaces 4.4.0
tibco activespaces 4.4.0
tibco activespaces 4.5.0
tibco activespaces 4.5.0
tibco activespaces 4.5.0
tibco activespaces 4.6.0
tibco activespaces 4.6.0
tibco activespaces 4.6.0
tibco activespaces 4.6.1
tibco activespaces 4.6.1
tibco activespaces 4.6.1
tibco activespaces 4.6.2
tibco activespaces 4.6.2
tibco activespaces 4.6.2
tibco eftl 6.2.0
tibco eftl 6.2.0
tibco eftl 6.2.0
tibco eftl 6.3.0
tibco eftl 6.3.0
tibco eftl 6.3.0
tibco eftl 6.3.1
tibco eftl 6.3.1
tibco eftl 6.3.1
tibco eftl 6.4.0
tibco eftl 6.4.0
tibco eftl 6.4.0
tibco eftl 6.5.0
tibco eftl 6.5.0
tibco eftl 6.5.0
tibco eftl 6.6.0
tibco eftl 6.6.0
tibco eftl 6.6.0
tibco eftl 6.6.1
tibco eftl 6.6.1
tibco eftl 6.6.1
tibco eftl 6.7.0
tibco eftl 6.7.0
tibco eftl 6.7.0
tibco ftl 6.2.0
tibco ftl 6.2.0
tibco ftl 6.2.0
tibco ftl 6.3.0
tibco ftl 6.3.0
tibco ftl 6.3.0
tibco ftl 6.3.1
tibco ftl 6.3.1
tibco ftl 6.3.1
tibco ftl 6.4.0
tibco ftl 6.4.0
tibco ftl 6.4.0
tibco ftl 6.5.0
tibco ftl 6.5.0
tibco ftl 6.5.0
tibco ftl 6.6.0
tibco ftl 6.6.0
tibco ftl 6.6.0
tibco ftl 6.6.1
tibco ftl 6.6.1
tibco ftl 6.6.1
tibco ftl 6.7.0
tibco ftl 6.7.0
tibco ftl 6.7.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "D629C1A4-DB9E-4B2C-9A78-E4608DF20402",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "BEEE3367-C78C-4D1D-959F-28F2ED4A7548",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "5C5F9EFC-671A-49F1-92AC-86A5760D72BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "E56A1CF8-3907-48DB-81CC-5C7E13D80F9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "0E667C4C-A147-4BA5-A04E-9235AA038F17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.4.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "57C92318-24AB-42A1-8F27-2552496F5962",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "5C4CFCEF-DFA6-4CF7-B2A3-961477917E6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "D60BB933-EAE7-4C5E-8210-1494F2367D36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.5.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "0C076170-90C8-4872-BDC9-3212642177B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "4E7D8BF1-8D74-41E1-A853-F6E848E1F98C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "0C77F3A3-2C47-4B45-86B8-D5F050AB2BF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B5DEDA14-4027-432C-B98C-108E0EC22BAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:community:*:*:*",
              "matchCriteriaId": "51841D47-A6C0-4029-8BD5-791C6379D864",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:developer:*:*:*",
              "matchCriteriaId": "029C9F40-0FD8-47D9-906A-0E9C46024C69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "F3205BA1-5F31-4003-AC6C-12EE154F9413",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:community:*:*:*",
              "matchCriteriaId": "D06EE4F3-496A-4246-A127-AE4E14AE6B87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:developer:*:*:*",
              "matchCriteriaId": "DBFC3DDF-8D8B-4165-A574-82DA436FBE77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:activespaces:4.6.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "8F632248-028D-4233-8FD2-0F6B8247E2EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "84E7868B-5BE6-4BE2-A34F-8B93DEAD00DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "B17407F4-2F7B-4A0F-9EF3-5266A4151371",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "ACF6B615-FF32-429D-9AE9-3F761385B0F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "FAAF3359-80A0-4603-9F46-985EF3F7783D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "7A8BD048-0D83-4820-97CF-E17E14558E26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E9A9B854-3145-4D75-8CB8-13A7691212A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:community:*:*:*",
              "matchCriteriaId": "9027C05A-C291-4E6C-A837-634EA3527383",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:developer:*:*:*",
              "matchCriteriaId": "7EC71AE7-6E51-4D69-A813-8A5FA8426612",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.3.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "A7AC8D4C-EBE3-43B7-9145-96363727597C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "8F6A77B5-510C-44AE-8774-1A3E7C2AF461",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "5A843829-0AC4-4F7B-8CE2-1D6A5EAE577D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.4.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "82FC3703-BFAD-423F-A58F-1990F948D673",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "15619E54-5711-47B9-B7EB-BA028CDFE301",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "7AB09709-3AB7-40DE-9E8F-412673DA828D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.5.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "1738BA42-E260-44A1-B885-EB7108B205FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "766D725D-85E2-48D9-B225-185E383D87F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "4B78899C-F97D-4679-99ED-C2414B82D0D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "254CC54E-2E20-4C71-8A1C-92AD2C226479",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:community:*:*:*",
              "matchCriteriaId": "C7BC3BE1-CD23-4003-84FA-D03940430DF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:developer:*:*:*",
              "matchCriteriaId": "C5688C44-05E0-4927-A26E-235CFF7EAF04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.6.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "308EB3E3-7534-47B2-822B-98ED3911E6A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "239AC202-82E0-4C26-A0FB-4A8435FCD5D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "E978B111-02A6-4167-9F56-89E9A30CF7C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:eftl:6.7.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "E950DD67-B799-4A46-97CD-E5B69494E92E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "38E8B639-69C2-442D-9D24-74BBC77E2559",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "0955AFA2-947E-4D8E-89AB-F2C61236EAA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "8A25520E-8099-448C-85A2-A1FE41BB0BF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "10AB5782-E640-4064-8598-D83CFC11F7E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "A0A3C5BB-F5C3-4C6B-ADD2-9F1113B7E9C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "9F2E4929-E11A-4A7E-8CFD-E268D26D91FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:community:*:*:*",
              "matchCriteriaId": "D795CEDE-E585-43BE-84C3-B6D87F14B1FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:developer:*:*:*",
              "matchCriteriaId": "C874D773-AC4B-467A-B2CF-4C3B3171F8FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.3.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "5DD8A9EB-D773-4354-9801-AAA42B9C3093",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "A8567FF5-D0E3-43B8-B86F-6FCD742E66D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "891D9445-A932-48C2-8CEF-51E0D07F5583",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.4.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "95C9E7BD-0BD4-467D-A51E-E918B70F1250",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "A5327841-C2DF-4971-A9EB-6427ECF2CDDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "F376D569-8B82-4988-900F-FAF8F8B48D22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.5.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "BFF3AFB8-4D7E-4036-A910-E7508E1FE74E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "1CC754F5-E59C-40C6-8C1D-C138FA652225",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "BF79A77E-72C1-4855-89F5-DA3E603A338C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "0B5EEF4E-C78A-46F3-8C5C-1B4BE853535B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:community:*:*:*",
              "matchCriteriaId": "0860A10B-E692-4FFC-A501-7F224099B9CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:developer:*:*:*",
              "matchCriteriaId": "53A7A5B7-D065-4D7F-B7F0-577CE624EBA6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.6.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B25D0767-BD16-4536-8D4F-3F6F1998DEC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "5CA76F30-C882-4AA6-9221-66757C60668C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:developer:*:*:*",
              "matchCriteriaId": "EC817235-C135-48C5-92EB-2F0F23F712E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ftl:6.7.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "54DB5EFD-5F7E-47FB-AD43-B4C98E1295DF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.\u0027s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0."
    },
    {
      "lang": "es",
      "value": "El servidor FTL (tibftlserver) y las im\u00e1genes Docker que contienen los componentes tibftlserver de TIBCO Software Inc. TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, y TIBCO eFTL - Enterprise Edition. contienen una vulnerabilidad que te\u00f3ricamente permite a un usuario de FTL no administrativo y autenticado enga\u00f1ar a los componentes afectados para que creen certificados ileg\u00edtimos. Estos certificados generados de forma maliciosa pueden ser usados para habilitar ataques de tipo man-in-the-middle o para escalar privilegios de forma que el usuario malicioso tenga privilegios administrativos. Las versiones afectadas son TIBCO ActiveSpaces - Community Edition de TIBCO Software Inc.: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6.2, TIBCO ActiveSpaces - Developer Edition: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6. 2, TIBCO ActiveSpaces - Enterprise Edition: versiones 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1 y 4.6.2, TIBCO FTL - Community Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO FTL - Developer Edition: versiones 6. 2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO FTL - Enterprise Edition: versiones 6.2.0, 6.3.0, 6. 3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0, TIBCO eFTL - Community Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5. 0, 6.6.0, 6.6.1 y 6.7.0, TIBCO eFTL - Developer Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6. 1 y 6.7.0, y TIBCO eFTL - Enterprise Edition: versiones 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1 y 6.7.0"
    }
  ],
  "id": "CVE-2021-35497",
  "lastModified": "2024-11-21T06:12:23.117",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security@tibco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-10-05T18:15:07.690",
  "references": [
    {
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/services/support/advisories"
    },
    {
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/services/support/advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497"
    }
  ],
  "sourceIdentifier": "security@tibco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.