CVE-2019-17333 - Vulnerability Details - OpenCVE

The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tibco	Ebx

Configuration 1 [-]

OR	cpe:2.3:a:tibco:ebx::::::::
	cpe:2.3:a:tibco:ebx::::::::
	cpe:2.3:a:tibco:ebx:5.8.1:-::::::
	cpe:2.3:a:tibco:ebx:5.8.1:fixr::::::
	cpe:2.3:a:tibco:ebx:5.8.1:fixs::::::

No data.

References

Link	Providers
http://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx

History

No history.

MITRE

Status: PUBLISHED

Assigner: tibco

Published: 2020-02-19T18:20:19.016640Z

Updated: 2024-09-17T03:52:40.294Z

Reserved: 2019-10-07T00:00:00

Link: CVE-2019-17333

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-02-19T19:15:11.913

Modified: 2024-11-21T04:32:06.390

Link: CVE-2019-17333

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "TIBCO EBX", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "5.8.1.fixS", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "affected", "version": "5.9.3"}, {"status": "affected", "version": "5.9.4"}, {"status": "affected", "version": "5.9.5"}, {"status": "affected", "version": "5.9.6"}, {"status": "affected", "version": "5.9.7"}]}], "datePublic": "2020-02-19T00:00:00", "descriptions": [{"lang": "en", "value": "The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-19T18:20:18", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO EBX versions 5.8.1.fixS and below update to version 5.8.1.fixT or higher\nTIBCO EBX versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7 update to version 5.9.8 or higher"}], "source": {"discovery": "INTERNAL"}, "title": "TIBCO EBX Exposes Cross-Site Scripting Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2020-02-19T17:00:00Z", "ID": "CVE-2019-17333", "STATE": "PUBLIC", "TITLE": "TIBCO EBX Exposes Cross-Site Scripting Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO EBX", "version": {"version_data": [{"version_affected": "<=", "version_value": "5.8.1.fixS"}, {"version_affected": "=", "version_value": "5.9.3"}, {"version_affected": "=", "version_value": "5.9.4"}, {"version_affected": "=", "version_value": "5.9.5"}, {"version_affected": "=", "version_value": "5.9.6"}, {"version_affected": "=", "version_value": "5.9.7"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component."}]}]}, "references": {"reference_data": [{"name": "http://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "http://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO EBX versions 5.8.1.fixS and below update to version 5.8.1.fixT or higher\nTIBCO EBX versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7 update to version 5.9.8 or higher"}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:40:14.487Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2019-17333", "datePublished": "2020-02-19T18:20:19.016640Z", "dateReserved": "2019-10-07T00:00:00", "dateUpdated": "2024-09-17T03:52:40.294Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:ebx:*:*:*:*:*:*:*:*", "matchCriteriaId": "AAB8F5FE-1D5F-4F03-B568-B00BF1ECF124", "versionEndExcluding": "5.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ebx:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BFBD853-399B-49F1-B4E6-DFD0B4A124A1", "versionEndIncluding": "5.9.7", "versionStartIncluding": "5.9.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ebx:5.8.1:-:*:*:*:*:*:*", "matchCriteriaId": "57D9705E-E75A-4A8E-8FAA-C7EA423F37CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ebx:5.8.1:fixr:*:*:*:*:*:*", "matchCriteriaId": "79A6BA4E-72D4-4ED4-8415-23ED5D64DB44", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ebx:5.8.1:fixs:*:*:*:*:*:*", "matchCriteriaId": "67BE008B-0783-457A-8EDA-D96899964C33", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7."}, {"lang": "es", "value": "El componente Web server de TIBCO EBX de TIBCO Software Inc, contiene una vulnerabilidad que te\u00f3ricamente permite a usuarios autenticados llevar a cabo ataques de tipo cross-site scripting (XSS) almacenado. Las versiones afectadas son TIBCO EBX de TIBCO Software Inc.: versiones 5.8.1.fixS y por debajo, versiones 5.9.3, 5.9.4, 5.9.5, 5.9.6 y 5.9.7."}], "id": "CVE-2019-17333", "lastModified": "2024-11-21T04:32:06.390", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "security@tibco.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-19T19:15:11.913", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "http://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2020/02/tibco-security-advisory-february-19-2020-tibco-ebx"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}