TIBCO Data Virtualization Arbitrary File Download vulnerability
CVE-2021-35500

6.3MEDIUM

Key Information:

Vendor

Tibco
Status
Tibco Data Virtualization
Tibco Data Virtualization For Aws Marketplace
Vendor
CVE Published:
12 January 2022

What is CVE-2021-35500?

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.

Affected Version(s)

TIBCO Data Virtualization <= 8.3.0

TIBCO Data Virtualization 8.4.0

TIBCO Data Virtualization 8.5.0

References

https://www.tibco.com/services/support/advisories
x_refsource_CONFIRM
https://www.tibco.com/support/advisories/2022/01/tibco-se...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.