PT-2022-10464 · Tibco Software · Tibco Data Virtualization+1

Published 2022-01-12 · Updated 2022-01-19 · CVE-2021-35500

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TIBCO Data Virtualization versions 8.5.0 and below TIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below

Description The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system.

Recommendations For TIBCO Data Virtualization versions 8.5.0 and below, consider restricting access to sensitive files and directories to minimize the risk of exploitation. For TIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below, consider restricting access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-35500

Affected Products

Tibco Data Virtualization

Tibco Data Virtualization For Aws Marketplace

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-35500 · Security Note
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35500 · Vendor Advisory
• https://t.me/cvenotify/25337 · Telegram Post
• https://t.me/cvenotify/25666 · Telegram Post