TIBCO API Exchange Processes OAuth Incorrectly
CVE-2019-11208

6.4MEDIUM

Key Information:

Vendor
Tibco
Status
Tibco Api Exchange Gateway
Tibco Api Exchange Gateway Distribution For Tibco Silver Fabric
Vendor
CVE Published:
8 August 2019

Summary

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Affected Version(s)

TIBCO API Exchange Gateway 2.3.1 and prior

TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric 2.3.1 and prior

References

http://www.tibco.com/services/support/advisories
x_refsource_MISC
https://www.tibco.com/support/advisories/2019/08/tibco-se...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.