PT-2021-15425 · Tibco Software · Tibco Bpm Enterprise+1

Published 2021-01-26 · Updated 2021-02-03 · CVE-2021-23272

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIBCO BPM Enterprise versions 4.3.0 and below TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric versions 4.3.0 and below

Description The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting (XSS) attack on the affected system.

Recommendations For TIBCO BPM Enterprise versions 4.3.0 and below, update to a version above 4.3.0 to resolve the issue. For TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric versions 4.3.0 and below, update to a version above 4.3.0 to resolve the issue. As a temporary workaround, consider restricting network access to the affected system to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-23272

Affected Products

Tibco Bpm Enterprise

Tibco Bpm Enterprise Distribution For Tibco Silver Fabric

References · 5

• http://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23272 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23272 · Vendor Advisory
• https://t.me/cibsecurity/22675 · Telegram Post
• https://t.me/cvenotify/8981 · Telegram Post