CVE-2020-9414: TIBCO Managed File Transfer reflected XSS vulerability
First published: Tue Jun 30 2020(Updated: )
The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Managed File Transfer Command Center | <8.2.1 | |
| TIBCO Managed File Transfer Internet Server | <8.2.1 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO Managed File Transfer Command Center versions 8.2.1 and below update to version 8.3.0 or higher TIBCO Managed File Transfer Internet Server versions 8.2.1 and below update to version 8.3.0 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-9414?
CVE-2020-9414 is a vulnerability in the MFT admin service component of TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server.
How severe is CVE-2020-9414?
CVE-2020-9414 has a severity rating of critical, with a score of 8.8
What is the affected software for CVE-2020-9414?
The affected software for CVE-2020-9414 is TIBCO Managed File Transfer Command Center version up to 8.2.1 and TIBCO Managed File Transfer Internet Server version up to 8.2.1.
How can an authenticated user exploit CVE-2020-9414?
An authenticated user with specific permissions can exploit CVE-2020-9414 to obtain the session identifier of another user.
How can I fix CVE-2020-9414?
To fix CVE-2020-9414, it is recommended to apply the latest security patches provided by TIBCO Software Inc. and keep the affected software up to date.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/tags
- agent/first-publish-date
- agent/description
- vendor/tibco
- canonical/tibco managed file transfer command center
- canonical/tibco managed file transfer internet server