PT-2022-15663 · Tibco Software · Tibco Managed File Transfer Platform Server For Z/Linux+1

Published 2022-03-30 · Updated 2022-04-07 · CVE-2022-22772

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below TIBCO Managed File Transfer Platform Server for z/Linux versions 8.1.0 and below

Description The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server contain a difficult to exploit Remote Code Execution (RCE) vulnerability. This allows a low privileged attacker with network access to execute arbitrary code on the affected system.

Recommendations For TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below, consider disabling the cfsend, cfrecv, and CyberResp components until a patch is available. For TIBCO Managed File Transfer Platform Server for z/Linux versions 8.1.0 and below, consider disabling the cfsend, cfrecv, and CyberResp components until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-22772

Affected Products

Tibco Managed File Transfer Platform Server

Tibco Managed File Transfer Platform Server For Z/Linux

References · 5

• https://osv.dev/vulnerability/CVE-2022-22772 · Vendor Advisory
• https://tibco.com/support/advisories/2022/03/tibco-security-advisory-march-30-2022-tibco-managed-file-transfer-2022-22772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22772 · Security Note
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://t.me/cibsecurity/39838 · Telegram Post