FKIE_CVE-2022-22769

Vulnerability from fkie_nvd - Published: 2022-01-19 20:15 - Updated: 2024-11-21 06:47
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
The Web server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.124 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, 5.9.14, and 5.9.15, TIBCO EBX: versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3, TIBCO EBX Add-ons: versions 3.20.18 and below, TIBCO EBX Add-ons: versions 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, and 4.5.6, TIBCO EBX Add-ons: versions 5.0.0, 5.0.1, 5.1.0, 5.1.1, and 5.2.0, and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.1.0 and below.
References
security@tibco.comhttps://www.tibco.com/services/support/advisoriesThird Party Advisory
security@tibco.comhttps://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-19-2022-tibco-ebx-2022-22769Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tibco.com/services/support/advisoriesThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-19-2022-tibco-ebx-2022-22769Third Party Advisory
Impacted products
Vendor Product Version
tibco ebx *
tibco ebx 5.9.3
tibco ebx 5.9.4
tibco ebx 5.9.5
tibco ebx 5.9.6
tibco ebx 5.9.7
tibco ebx 5.9.8
tibco ebx 5.9.9
tibco ebx 5.9.10
tibco ebx 5.9.11
tibco ebx 5.9.12
tibco ebx 5.9.13
tibco ebx 5.9.14
tibco ebx 5.9.15
tibco ebx 6.0.0
tibco ebx 6.0.1
tibco ebx 6.0.2
tibco ebx 6.0.3
tibco ebx_add-ons *
tibco ebx_add-ons 4.1.0
tibco ebx_add-ons 4.2.0
tibco ebx_add-ons 4.2.1
tibco ebx_add-ons 4.2.2
tibco ebx_add-ons 4.3.0
tibco ebx_add-ons 4.3.1
tibco ebx_add-ons 4.3.2
tibco ebx_add-ons 4.3.3
tibco ebx_add-ons 4.3.4
tibco ebx_add-ons 4.4.0
tibco ebx_add-ons 4.4.1
tibco ebx_add-ons 4.4.2
tibco ebx_add-ons 4.4.3
tibco ebx_add-ons 4.5.0
tibco ebx_add-ons 4.5.1
tibco ebx_add-ons 4.5.2
tibco ebx_add-ons 4.5.3
tibco ebx_add-ons 4.5.4
tibco ebx_add-ons 4.5.5
tibco ebx_add-ons 4.5.6
tibco ebx_add-ons 5.0.0
tibco ebx_add-ons 5.0.1
tibco ebx_add-ons 5.1.0
tibco ebx_add-ons 5.1.1
tibco ebx_add-ons 5.2.0
tibco product_and_service_catalog_powered_by_tibco_ebx *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:ebx:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0165AC28-D01B-4485-B96A-2E3060ACB853",
              "versionEndExcluding": "5.8.125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A0D1197B-AC96-467F-A450-F259CEBDB235",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A36F7E33-C880-4A41-AEB9-43EB9A076AD5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE7057CC-ECE4-4AB2-B180-15CC8025F764",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "7306713C-5D57-4377-BA97-997F3F05847D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "0414C7DD-2AAB-46AA-8690-4F51AAE06A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "8B3BA2EB-59DF-4356-B1A3-03C15E96FED8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EA9917D-DFA1-4BD7-953C-F40781A0245A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AA4FA1F-070E-4581-BA01-FC4CEF2A69A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B85833E-BC58-4226-93C2-63D1E755D6A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EA6FB45-F7A6-49F0-B943-97CBEB406FC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6857B3C-4BA0-4464-A949-F3349240D820",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "89A36F43-5874-402C-8BB7-7D4082D30B70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:5.9.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "659CBEC1-8244-4C0D-B949-DB7BDF0FB0A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:6.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7ED1CAF7-5025-4E31-8CD1-DF6234A59194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:6.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "82BC70F7-61CD-459B-9EDB-4BDA09981B1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:6.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E54A85-E839-4E27-B913-D000F84BFF44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx:6.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "84A7765C-3AD3-4A3A-A42A-28D5FD9A6D67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E7A106E-A91A-4761-A2B2-30B863539D7D",
              "versionEndExcluding": "3.20.19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB945CC7-B8DB-4954-99CF-5AA3F795556C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3466D471-4B75-468D-B14F-53E7B303BA14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "50366C95-1167-47B6-BE4B-7D8AA1969DEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35564BC3-5F27-4D1A-B0DE-339A623AA8B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "81AD751B-10E3-4BAE-A6E4-549C3CD6A955",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F396C7BA-E805-4D59-B5E0-9A27524125DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE69EB4E-C91F-4F33-868D-71EAF123B266",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "57C53AE4-A838-4E60-964B-8DAC442B54EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8DE2CB3-9C94-436E-BE0F-EB890E783626",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "68736392-51F0-4F2F-8458-F6DCAB19D68C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7BCA30A-DD78-4745-88E1-6D1B4F04BCED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1DE3A7CF-339B-4442-BCE0-A261F5CFFD0C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "8285BD7A-DB0B-49BD-807F-9848669639C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "113B5E93-5E3A-4798-BD34-D0DC6E8FAAAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "48FBBD82-8EA3-4FFD-9D4B-F6B5B4245E84",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "546436F8-8416-48FD-A40C-6D29659CC68E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C1B7EE5-A7AA-4729-9E16-7A1BAFBBAFB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FB66851-2B87-4C2D-8DBA-75788791CBFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5C77659-6D42-4E13-A1F1-B3626CFF52EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "1961A758-6218-4925-8088-70269A7E9924",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2B188CD-0691-4292-937B-64A7FF0B7FC1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:5.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8F9AE13-6EF3-4243-98F6-4E642BC2193D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAD9CCAA-3E2F-4AA1-B00E-C135E3426F78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:5.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E45FBEA-EF36-44AA-9BC2-6D4098CA8027",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DFB572F-32AC-4AC3-BA0D-2BD5EDD05D53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:product_and_service_catalog_powered_by_tibco_ebx:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "46BDE4B1-18D7-4D20-B017-B6CF8B3FE931",
              "versionEndExcluding": "1.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web server component of TIBCO Software Inc.\u0027s TIBCO EBX, TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO EBX: versions 5.8.124 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, 5.9.14, and 5.9.15, TIBCO EBX: versions 6.0.0, 6.0.1, 6.0.2, and 6.0.3, TIBCO EBX Add-ons: versions 3.20.18 and below, TIBCO EBX Add-ons: versions 4.1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, and 4.5.6, TIBCO EBX Add-ons: versions 5.0.0, 5.0.1, 5.1.0, 5.1.1, and 5.2.0, and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.1.0 and below."
    },
    {
      "lang": "es",
      "value": "El componente del servidor Web de TIBCO Software Inc. TIBCO EBX, TIBCO EBX, TIBCO EBX Add-ons, TIBCO EBX Add-ons, TIBCO EBX Add-ons, y TIBCO Product and Service Catalog powered by TIBCO EBX contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante poco privilegiado y con acceso a la red ejecutar un ataque de tipo Cross Site Scripting (XSS) Almacenado en el sistema afectado. Un ataque con \u00e9xito usando esta vulnerabilidad requiere la interacci\u00f3n humana de una persona diferente del atacante. Las versiones afectadas son TIBCO Software Inc.\u0027s TIBCO EBX: versiones 5.8.124 y anteriores, TIBCO EBX: versiones 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9. 11, 5.9.12, 5.9.13, 5.9.14 y 5.9.15, TIBCO EBX: versiones 6.0.0, 6.0.1, 6.0.2 y 6.0.3, TIBCO EBX Add-ons: versiones 3.20.18 y anteriores, TIBCO EBX Add-ons: versiones 4. 1.0, 4.2.0, 4.2.1, 4.2.2, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5 y 4.5. 6, TIBCO EBX Add-ons: versiones 5.0.0, 5.0.1, 5.1.0, 5.1.1 y 5.2.0, y TIBCO Product and Service Catalog powered by TIBCO EBX: versiones 1.1.0 y anteriores"
    }
  ],
  "id": "CVE-2022-22769",
  "lastModified": "2024-11-21T06:47:24.623",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "security@tibco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-01-19T20:15:07.507",
  "references": [
    {
      "source": "security@tibco.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tibco.com/services/support/advisories"
    },
    {
      "source": "security@tibco.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-19-2022-tibco-ebx-2022-22769"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tibco.com/services/support/advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-19-2022-tibco-ebx-2022-22769"
    }
  ],
  "sourceIdentifier": "security@tibco.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.