PT-2019-15092 · Tibco Software · Tibco Ebx Add-Ons

Published 2019-11-12 · Updated 2019-11-15 · CVE-2019-17331

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO EBX Add-ons versions up to and including 3.20.13 TIBCO EBX Add-ons version 4.1.0

Description The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an issue that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks.

Recommendations For TIBCO EBX Add-ons versions up to and including 3.20.13, update to a version later than 3.20.13 to resolve the issue. For TIBCO EBX Add-ons version 4.1.0, consider disabling the Data Exchange Web Interface component as a temporary workaround until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17331

Affected Products

Tibco Ebx Add-Ons

References · 4

• https://osv.dev/vulnerability/CVE-2019-17331 · Vendor Advisory
• https://tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17331 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17331 · Security Note