PT-2020-16640 · Tibco Software · Tibco Partnerexpress

Published 2020-12-15 · Updated 2021-07-21 · CVE-2020-27147

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIBCO PartnerExpress version 6.2.0

Description The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains an issue that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API.

Recommendations For version 6.2.0, consider restricting access to the REST API component until a patch is available. As a temporary workaround, consider disabling the REST API component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2020-27147

Affected Products

Tibco Partnerexpress

References · 5

• https://osv.dev/vulnerability/CVE-2020-27147 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://tibco.com/support/advisories/2020/12/tibco-security-advisory-december-15-2020-tibco-partnerexpress · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27147 · Security Note
• https://t.me/cibsecurity/20867 · Telegram Post