PT-2020-16639 · Tibco Software · Tibco Iprocess Workspace

Published 2020-11-10 · Updated 2020-11-24 · CVE-2020-27146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO iProcess Workspace (Browser) versions 11.6.0 and below

Description The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains an issue that theoretically allows an unauthenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the affected system. A successful attack using this issue requires human interaction from an authenticated user other than the attacker.

Recommendations For versions 11.6.0 and below, update to a version above 11.6.0 to resolve the issue. As a temporary workaround, consider implementing additional security measures to prevent CSRF attacks, such as validating request origins and using anti-CSRF tokens. Restrict access to the affected system to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-27146

Affected Products

Tibco Iprocess Workspace

References · 5

• http://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27146 · Vendor Advisory
• https://tibco.com/support/advisories/2020/11/tibco-security-advisory-november-10-2020-tibco-iprocess-workspace · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27146 · Security Note
• https://t.me/cibsecurity/16107 · Telegram Post