PT-2021-23735 · Tibco · Tibco Partnerexpress

Published 2021-11-16 · Updated 2021-11-19 · CVE-2021-43047

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO PartnerExpress versions 6.2.1 and below

Description The issue concerns Stored and Reflected Cross Site Scripting (XSS) vulnerabilities in the Interior Server and Gateway Server components. These vulnerabilities can be exploited by a low-privileged attacker to execute scripts targeting the affected system or the victim's local system through social engineering, requiring human interaction from a person other than the attacker.

Recommendations For versions 6.2.1 and below, update to a version above 6.2.1 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-43047

Affected Products

Tibco Partnerexpress

References · 4

• https://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43047 · Security Note
• https://tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-partnerexpress-2021-43047 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43047 · Vendor Advisory