XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator
CVE-2018-5433

6.5MEDIUM

Key Information:

Vendor
Tibco
Status
Tibco Administrator - Enterprise Edition
Tibco Administrator - Enterprise Edition For Z/linux
Vendor
CVE Published:
13 June 2018

Summary

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions up to and including 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux: versions up to and including 5.9.1.

Affected Version(s)

TIBCO Administrator - Enterprise Edition <= 5.10.0

TIBCO Administrator - Enterprise Edition for z/Linux <= 5.9.1

References

https://www.tibco.com/support/advisories/2018/06/security...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104451
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

TIBCO would like to extend its appreciation to Baker Hamilton at Bishop Fox for discovery of this vulnerability.
.