CVE-2019-17330: TIBCO EBX Exposes Multiple Cross-Site Scripting Vulnerabilities
First published: Tue Nov 12 2019(Updated: )
The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO EBX | <=5.8.1 | |
| TIBCO EBX | =5.8.1-fixr | |
| TIBCO EBX | =5.9.3 | |
| TIBCO EBX | =5.9.4 | |
| TIBCO EBX | =5.9.5 | |
| TIBCO EBX | =5.9.6 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO EBX versions 5.8.1.fixR and below update to version 5.8.1.fixS or higher TIBCO EBX versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6 update to version 5.9.7 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-17330?
CVE-2019-17330 is a vulnerability in the Web server component of TIBCO EBX that allows authenticated users to perform stored cross-site scripting (XSS) attacks and unauthenticated users to perform reflected cross-site scripting attacks.
What software is affected by CVE-2019-17330?
Affected software includes TIBCO EBX versions up to and including 5.8.1, 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
How severe is CVE-2019-17330?
CVE-2019-17330 has a severity rating of 9.6 (Critical).
How can authenticated users exploit CVE-2019-17330?
Authenticated users can exploit CVE-2019-17330 to perform stored cross-site scripting (XSS) attacks.
How can unauthenticated users exploit CVE-2019-17330?
Unauthenticated users can exploit CVE-2019-17330 to perform reflected cross-site scripting attacks.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/severity
- agent/title
- agent/weakness
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- vendor/tibco
- canonical/tibco ebx
- version/tibco ebx/5.8.1
- version/tibco ebx/5.8.1-fixr
- version/tibco ebx/5.9.3
- version/tibco ebx/5.9.4
- version/tibco ebx/5.9.5
- version/tibco ebx/5.9.6