PT-2022-20179 · Tibco Software · Tibco Iway Service Manager

Published 2022-08-02 · Updated 2022-08-09 · CVE-2022-30571

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TIBCO iWay Service Manager versions 8.0.6 and below

Description The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities. These vulnerabilities allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system.

Recommendations For versions 8.0.6 and below, update to a version above 8.0.6 to resolve the issue. As a temporary workaround, consider restricting access to the iWay Service Manager Console component to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30571

Affected Products

Tibco Iway Service Manager

References · 7

• https://osv.dev/vulnerability/CVE-2022-30571 · Vendor Advisory
• https://tibco.com/support/advisories/2022/07/tibco-security-advisory-august-2-2022-tibco-iway-sm-cve-2022-30571 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30571 · Security Note
• https://t.me/cibsecurity/47421 · Telegram Post
• https://t.me/cvenotify/34170 · Telegram Post
• https://t.me/cvenotify/34432 · Telegram Post