CVE-2021-35500 - Vulnerability Details - OpenCVE

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tibco	Data Virtualization Data Virtualization For Aws Marketplace

Configuration 1 [-]

OR	cpe:2.3:a:tibco:data_virtualization::::::::
	cpe:2.3:a:tibco:data_virtualization:8.4.0:::::::*
	cpe:2.3:a:tibco:data_virtualization:8.5.0:::::::*
	cpe:2.3:a:tibco:data_virtualization_for_aws_marketplace::::::::

No data.

References

Link	Providers
https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500

History

No history.

MITRE

Status: PUBLISHED

Assigner: tibco

Published: 2022-01-12T18:40:11.398297Z

Updated: 2024-09-16T16:18:36.002Z

Reserved: 2021-06-24T00:00:00

Link: CVE-2021-35500

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-01-12T19:15:08.130

Modified: 2024-11-21T06:12:23.537

Link: CVE-2021-35500

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "8.3.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "8.4.0"}]}, {"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "8.5.0"}]}, {"product": "TIBCO Data Virtualization for AWS Marketplace", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "8.5.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2022-01-12T00:00:00", "descriptions": [{"lang": "en", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-12T19:06:22", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Data Virtualization versions 8.3.0 and below update to version 8.3.1 or later\nTIBCO Data Virtualization version 8.4.0 update to version 8.4.1 or later\nTIBCO Data Virtualization version 8.5.0 update to version 8.5.1 or later\nTIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below update to version 8.5.1 or later"}], "source": {"discovery": "USER"}, "title": "TIBCO Data Virtualization Arbitrary File Download vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2022-01-12T17:00:00Z", "ID": "CVE-2021-35500", "STATE": "PUBLIC", "TITLE": "TIBCO Data Virtualization Arbitrary File Download vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.3.0"}]}}, {"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "=", "version_value": "8.4.0"}]}}, {"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "=", "version_value": "8.5.0"}]}}, {"product_name": "TIBCO Data Virtualization for AWS Marketplace", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.5.0"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system."}]}]}, "references": {"reference_data": [{"name": "https://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "https://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Data Virtualization versions 8.3.0 and below update to version 8.3.1 or later\nTIBCO Data Virtualization version 8.4.0 update to version 8.4.1 or later\nTIBCO Data Virtualization version 8.5.0 update to version 8.5.1 or later\nTIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below update to version 8.5.1 or later"}], "source": {"discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:40:46.397Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2021-35500", "datePublished": "2022-01-12T18:40:11.398297Z", "dateReserved": "2021-06-24T00:00:00", "dateUpdated": "2024-09-16T16:18:36.002Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:data_virtualization:*:*:*:*:*:*:*:*", "matchCriteriaId": "58C2A35E-A0EA-41B6-B48F-F4F014549D93", "versionEndIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization:8.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "CD2D931C-9084-4B44-A872-DC4B950042A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization:8.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "5B922E97-D9D6-4697-8253-76D26E5E8DBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization_for_aws_marketplace:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B4B7AA2-5578-4DDE-A7D1-0311A77A30C9", "versionEndIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}, {"lang": "es", "value": "El componente Data Virtualization Server de TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, y TIBCO Data Virtualization for AWS Marketplace contiene una vulnerabilidad dif\u00edcil de explotar que permite a un atacante con pocos privilegios y acceso local descargar archivos arbitrarios fuera del alcance de los permisos del usuario en el sistema afectado. Las versiones afectadas son TIBCO Data Virtualization de TIBCO Software Inc.: versiones 8.3.0 y anteriores, TIBCO Data Virtualization: versi\u00f3n 8.4.0, TIBCO Data Virtualization: versi\u00f3n 8.5.0, y TIBCO Data Virtualization para AWS Marketplace: versiones 8.5.0 y anteriores"}], "id": "CVE-2021-35500", "lastModified": "2024-11-21T06:12:23.537", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security@tibco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-01-12T19:15:08.130", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}