TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability
CVE-2018-5432

8HIGH

Key Information:

Vendor
Tibco
Status
Tibco Administrator - Enterprise Edition
Tibco Administrator - Enterprise Edition For Z/linux
Vendor
CVE Published:
13 June 2018

Summary

The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting (XSS) attacks by way of manipulating artifacts prior to uploading them. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions up to and including 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux: versions up to and including 5.9.1.

Affected Version(s)

TIBCO Administrator - Enterprise Edition <= 5.10.0

TIBCO Administrator - Enterprise Edition for z/Linux <= 5.9.1

References

http://www.securityfocus.com/bid/104458
vdb-entryx_refsource_BID
https://www.tibco.com/support/advisories/2018/06/security...
x_refsource_CONFIRM

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TIBCO would like to extend its appreciation to Baker Hamilton at Bishop Fox for discovery of this vulnerability.
.