PT-2019-19293 · Tibco · Tibco Activematrix Businessworks

Published 2019-04-09 · Updated 2022-10-14 · CVE-2019-8990

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO ActiveMatrix BusinessWorks versions up to and including 6.4.2

Description The HTTP Connector component of TIBCO ActiveMatrix BusinessWorks contains an issue that allows unauthenticated HTTP requests to be processed by the BusinessWorks engine when authentication is required, but only under specific conditions. This occurs when the HTTP "Basic Authentication" policy is used with an XML Authentication resource. In such cases, the BusinessWorks engine might use credentials from a prior HTTP request for authorization purposes.

Recommendations For versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue. As a temporary workaround, consider disabling the use of HTTP "Basic Authentication" policy with XML Authentication resources until a patch is available. Restrict access to the HTTP Connector component to minimize the risk of exploitation. Avoid using credentials from prior HTTP requests for authorization purposes in the affected configuration.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-8990

Affected Products

Tibco Activematrix Businessworks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-8990 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8990 · Vendor Advisory
• https://tibco.com/support/advisories/2019/04/tibco-security-advisory-april-9-2019-tibco-activematrix-businessworks · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• http://securityfocus.com/bid/107840 · Note