PT-2023-5701 · Tibco · Tibco Ebx Add-Ons

Publicado 2023-07-19 · Atualizado 2023-07-28 · CVE-2023-26217

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO EBX Add-ons versions 4.5.17 and below TIBCO EBX Add-ons versions 5.6.2 and below TIBCO EBX Add-ons version 6.1.0

Description The vulnerability in TIBCO EBX is related to the lack of protection of the SQL query structure, allowing a remote attacker to execute arbitrary SQL statements. A low-privileged user with import permissions and network access to the EBX server can exploit this issue. The vulnerability allows the execution of arbitrary SQL statements on the affected system.

Recommendations For TIBCO EBX Add-ons versions 4.5.17 and below, update to a version above 4.5.17 to resolve the issue. For TIBCO EBX Add-ons versions 5.6.2 and below, update to a version above 5.6.2 to resolve the issue. For TIBCO EBX Add-ons version 6.1.0, consider disabling the import functionality for low-privileged users until a patch is available.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-06371

CVE-2023-26217

Produtos afetados

Tibco Ebx Add-Ons

Referências · 5

• https://osv.dev/vulnerability/CVE-2023-26217 · Aviso do Fabricante
• https://t.me/cvenotify/54683 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26217 · Nota de Segurança
• https://tibco.com/services/support/advisories · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06371 · Nota de Segurança