CVE-2021-35493: TIBCO WebFOCUS Cross Site Scripting vulnerabilities
First published: Tue Sep 14 2021(Updated: )
The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO WebFOCUS Client: versions 8207.27.0 and below, TIBCO WebFOCUS Installer: versions 8207.27.0 and below, and TIBCO WebFOCUS Reporting Server: versions 8207.27.0 and below.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WebFOCUS | <=8207.27.0 | |
| WebFOCUS | <=8207.27.0 | |
| WebFOCUS | <=8207.27.0 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO WebFOCUS Client versions 8207.27.0 and below update to version 8207.28.0 or later TIBCO WebFOCUS Installer versions 8207.27.0 and below update to version 8207.28.0 or later TIBCO WebFOCUS Reporting Server versions 8207.27.0 and below update to version 8207.28.0 or later
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-35493?
CVE-2021-35493 has a high severity rating due to its potential for exploitation through stored and reflected cross-site scripting.
How do I fix CVE-2021-35493?
To fix CVE-2021-35493, users should upgrade to a patched version of TIBCO WebFOCUS Client, Installer, or Reporting Server that exceeds version 8207.27.0.
What components are affected by CVE-2021-35493?
CVE-2021-35493 affects TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server.
Who is affected by CVE-2021-35493?
Organizations using vulnerable versions of TIBCO WebFOCUS software are at risk of exploitation from CVE-2021-35493.
What types of vulnerabilities does CVE-2021-35493 include?
CVE-2021-35493 includes stored and reflected cross-site scripting (XSS) vulnerabilities.
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/tibco
- canonical/webfocus
- version/webfocus/8207.27.0