PT-2020-9908 · Tibco Software · Tibco Silver Fabric

Published 2020-08-11 · Updated 2020-08-14 · CVE-2019-17339

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO Silver Fabric versions 6.0.0 and below

Description The VirtualRouter component of TIBCO Software Inc.'s TIBCO Silver Fabric contains an issue that theoretically allows an attacker to inject scripts via URLs. An attacker could social engineer an authenticated user into submitting the URL, thus executing the script on the affected system with the privileges of the user.

Recommendations For versions 6.0.0 and below, update to a version above 6.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the VirtualRouter component to minimize the risk of exploitation. Avoid using URLs that could potentially be used to inject scripts until the issue is resolved.

Fix

Related Identifiers

CVE-2019-17339

Affected Products

Tibco Silver Fabric

References · 4

• https://osv.dev/vulnerability/CVE-2019-17339 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17339 · Security Note
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://t.me/cibsecurity/14077 · Telegram Post