CVE-2018-5433: XML eXternal Entity Expansion Vulnerabilities with TIBCO Administrator
The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions up to and including 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux: versions up to and including 5.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TIBCO Administrator - Enterprise Editionto a version that resolves this vulnerability.Fixed in 5.10.1 - Upgrade
Upgrade
TIBCO Administrator - Enterprise Edition for z/Linuxto a version that resolves this vulnerability.Fixed in 5.10.1
Event History
Frequently Asked Questions
What is CVE-2018-5433?
CVE-2018-5433 is a vulnerability in TIBCO Administrator server component that allows XML external entity expansion (XXE) attacks.
How does CVE-2018-5433 affect TIBCO Administrator?
CVE-2018-5433 affects TIBCO Administrator - Enterprise Edition and TIBCO Administrator - Enterprise Edition for z/Linux.
What is the severity of CVE-2018-5433?
The severity of CVE-2018-5433 is medium with a CVSS score of 6.5.
How can a malicious user exploit CVE-2018-5433?
A malicious user can exploit CVE-2018-5433 by performing XML external entity expansion (XXE) attacks to disclose host machine information.
Where can I find more information about CVE-2018-5433?
You can find more information about CVE-2018-5433 at the following references: [1] http://www.securityfocus.com/bid/104451 [2] https://www.tibco.com/support/advisories/2018/06/security-advisory-june-12-2018-tibco-administrator-enterprise-edition-2018-5433