PT-2023-5701 · Tibco · Tibco Ebx Add-Ons

Published 2023-07-19 · Updated 2023-07-28 · CVE-2023-26217

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO EBX Add-ons versions 4.5.17 and below TIBCO EBX Add-ons versions 5.6.2 and below TIBCO EBX Add-ons version 6.1.0

Description The vulnerability in TIBCO EBX is related to the lack of protection of the SQL query structure, allowing a remote attacker to execute arbitrary SQL statements. A low-privileged user with import permissions and network access to the EBX server can exploit this issue. The vulnerability allows the execution of arbitrary SQL statements on the affected system.

Recommendations For TIBCO EBX Add-ons versions 4.5.17 and below, update to a version above 4.5.17 to resolve the issue. For TIBCO EBX Add-ons versions 5.6.2 and below, update to a version above 5.6.2 to resolve the issue. For TIBCO EBX Add-ons version 6.1.0, consider disabling the import functionality for low-privileged users until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-06371

CVE-2023-26217

Affected Products

Tibco Ebx Add-Ons

References · 5

• https://osv.dev/vulnerability/CVE-2023-26217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26217 · Security Note
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06371 · Security Note
• https://t.me/cvenotify/54683 · Telegram Post