PT-2018-2688 · Tibco · Tibco Rendezvous Network Server+5

Publicado

2018-11-06

·

Atualizado

2019-10-09

·

CVE-2018-12414

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions TIBCO Rendezvous versions up to and including 8.4.5 TIBCO Rendezvous Developer Edition versions up to and including 8.4.5 TIBCO Rendezvous for z/Linux versions up to and including 8.4.5 TIBCO Rendezvous for z/OS versions up to and including 8.4.5 TIBCO Rendezvous Network Server versions up to and including 1.1.2 TIBCO Substation ES versions up to and including 2.12.2
Description The vulnerability in the components of TIBCO Rendezvous may allow an attacker to perform cross-site request forgery (CSRF) attacks, potentially leading to unauthorized access to protected information.
Recommendations For TIBCO Rendezvous versions up to and including 8.4.5, update to a version later than 8.4.5. For TIBCO Rendezvous Developer Edition versions up to and including 8.4.5, update to a version later than 8.4.5. For TIBCO Rendezvous for z/Linux versions up to and including 8.4.5, update to a version later than 8.4.5. For TIBCO Rendezvous for z/OS versions up to and including 8.4.5, update to a version later than 8.4.5. For TIBCO Rendezvous Network Server versions up to and including 1.1.2, update to a version later than 1.1.2. For TIBCO Substation ES versions up to and including 2.12.2, update to a version later than 2.12.2.

Correção

CSRF

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2019-01354
CVE-2018-12414

Produtos afetados

Tibco Rendezvous
Tibco Rendezvous Developer Edition
Tibco Rendezvous Network Server
Tibco Rendezvous For Z/Linux
Tibco Rendezvous For Z/Os
Tibco Substation Es