PT-2018-11149 · Tibco · Tibco Activematrix Businessworks Distribution For Tibco Silver Fabric+3

Published 2018-08-08 · Updated 2019-10-09 · CVE-2018-12408

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TIBCO ActiveMatrix BusinessWorks versions up to and including 5.13.0 TIBCO ActiveMatrix BusinessWorks for z/Linux versions up to and including 5.13.0 TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions up to and including 5.13.0

Description The BusinessWorks engine component contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages. This could disclose the contents of files accessible to a running BusinessWorks engine.

Recommendations For TIBCO ActiveMatrix BusinessWorks versions up to and including 5.13.0, update to a version later than 5.13.0 to resolve the issue. For TIBCO ActiveMatrix BusinessWorks for z/Linux versions up to and including 5.13.0, update to a version later than 5.13.0 to resolve the issue. For TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions up to and including 5.13.0, update to a version later than 5.13.0 to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-12408

Affected Products

Tibco Activematrix Businessworks

Tibco Activematrix Businessworks Distribution For Tibco Silver Fabric

Tibco Activematrix Businessworks For Z/Linux

Tibco Silver Fabric

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-12408 · Security Note
• https://tibco.com/support/advisories/2018/08/tibco-security-advisory-august-7-2018-tibco-activematrix-businessworks · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12408 · Vendor Advisory
• http://securityfocus.com/bid/105043 · Note