PT-2019-15093 · Tibco · Tibco Ebx Add-Ons

Published 2019-11-12 · Updated 2019-11-15 · CVE-2019-17332

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO EBX Add-ons versions up to and including 3.20.13 TIBCO EBX Add-ons versions 4.1.0 through 4.2.2

Description The Digital Asset Manager Web Interface component contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks.

Recommendations For TIBCO EBX Add-ons versions up to and including 3.20.13, update to a version later than 3.20.13 to resolve the issue. For TIBCO EBX Add-ons versions 4.1.0 through 4.2.2, update to a version later than 4.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the Digital Asset Manager Web Interface component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-17332

Affected Products

Tibco Ebx Add-Ons

References · 4

• https://tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17332 · Security Note
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17332 · Vendor Advisory