PT-2022-20180 · Tibco Software · Tibco Iway Service Manager

Published 2022-08-02 · Updated 2022-08-10 · CVE-2022-30572

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TIBCO iWay Service Manager versions 8.0.6 and below

Description The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains a Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system.

Recommendations For versions 8.0.6 and below, update to a version above 8.0.6 to resolve the issue. As a temporary workaround, consider restricting network access to the affected system to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-30572

Affected Products

Tibco Iway Service Manager

References · 6

• https://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30572 · Security Note
• https://tibco.com/support/advisories/2022/07/tibco-security-advisory-august-2-2022-tibco-iway-sm-cve-2022-30572 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30572 · Vendor Advisory
• https://t.me/cvenotify/34169 · Telegram Post
• https://t.me/cibsecurity/47426 · Telegram Post