CVE-2019-8990: TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication
First published: Tue Apr 09 2019(Updated: )
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
Credit: security@tibco.com security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO ActiveMatrix BusinessWorks | <=6.4.2 | |
| <=6.4.2 |
Remedy
TIBCO has released updated versions of the affected systems which address these issues. TIBCO ActiveMatrix BusinessWorks versions 6.4.2 and below update to 6.5.0 or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-8990?
CVE-2019-8990 is classified as a critical vulnerability due to its potential to allow unauthenticated HTTP requests to bypass authentication mechanisms.
How do I fix CVE-2019-8990?
To fix CVE-2019-8990, upgrade TIBCO ActiveMatrix BusinessWorks to version 6.5.0 or later, where the vulnerability has been addressed.
What software versions are affected by CVE-2019-8990?
CVE-2019-8990 affects TIBCO ActiveMatrix BusinessWorks versions up to and including 6.4.2.
What kind of attacks can CVE-2019-8990 facilitate?
CVE-2019-8990 can facilitate unauthorized access to the BusinessWorks engine, potentially leading to data leaks or malicious actions.
Is authentication safe in TIBCO ActiveMatrix BusinessWorks with CVE-2019-8990?
No, authentication is not safe in TIBCO ActiveMatrix BusinessWorks versions affected by CVE-2019-8990 as authentication requirements may be bypassed.
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/tibco
- canonical/tibco activematrix businessworks
- version/tibco activematrix businessworks/6.4.2