PT-2022-15666 · Tibco Software · Tibco Bpm Enterprise Distribution For Tibco Silver Fabric+1

Published 2022-05-17 · Updated 2022-05-25 · CVE-2022-22775

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO BPM Enterprise versions 4.3.1 and below TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric versions 4.3.1 and below

Description The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities. These vulnerabilities allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system.

Recommendations For TIBCO BPM Enterprise versions 4.3.1 and below, update to a version above 4.3.1 to resolve the issue. For TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric versions 4.3.1 and below, update to a version above 4.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the Workspace client component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22775

Affected Products

Tibco Bpm Enterprise

Tibco Bpm Enterprise Distribution For Tibco Silver Fabric

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-22775 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22775 · Vendor Advisory
• https://tibco.com/support/advisories/2022/05/tibco-security-advisory-may-17-2022-tibco-activematrix-bpm-cve-2022-22775 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://t.me/cibsecurity/42859 · Telegram Post