CVE-2019-8990: TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8990?
CVE-2019-8990 is classified as a critical vulnerability due to its potential to allow unauthenticated HTTP requests to bypass authentication mechanisms.
How do I fix CVE-2019-8990?
To fix CVE-2019-8990, upgrade TIBCO ActiveMatrix BusinessWorks to version 6.5.0 or later, where the vulnerability has been addressed.
What software versions are affected by CVE-2019-8990?
CVE-2019-8990 affects TIBCO ActiveMatrix BusinessWorks versions up to and including 6.4.2.
What kind of attacks can CVE-2019-8990 facilitate?
CVE-2019-8990 can facilitate unauthorized access to the BusinessWorks engine, potentially leading to data leaks or malicious actions.
Is authentication safe in TIBCO ActiveMatrix BusinessWorks with CVE-2019-8990?
No, authentication is not safe in TIBCO ActiveMatrix BusinessWorks versions affected by CVE-2019-8990 as authentication requirements may be bypassed.