PT-2020-4418 · Tibco · Tibco Managed File Transfer Platform Server

Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-9412

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0

Description: The issue is related to insufficient input validation in the file transfer component of the TIBCO Managed File Transfer Platform Server. This could potentially allow a remote attacker to execute arbitrary code. The vulnerability may also allow the execution of arbitrary commands at the privilege level of the affected system following a failed file transfer.

Recommendations: For TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below, update to a version above 7.1.0 to resolve the issue. For TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0, consider disabling the file transfer component until a patch is available. As a temporary workaround, restrict access to the file transfer component to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04946

CVE-2020-9412

Affected Products

Tibco Managed File Transfer Platform Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-9412 · Security Note
• https://tibco.com/support/advisories/2020/06/tibco-security-advisory-june-9-2020-tibco-managed-file-transfer-2020-9412 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20200611.6.pdf · Security Note
• https://bdu.fstec.ru/vul/2020-04946 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9412 · Vendor Advisory