ByteOS

TIBCO API Exchange Gateway

Product

Versions

Affected

2.3.1 and prior

Vendor

TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric

Product

Versions

Affected

2.3.1 and prior

Problem Types

Type	CWE ID	Description
text	N/A	The impact of this vulnerability includes the theoretical possibility that an attacker could gain access to all scopes defined for a given customer endpoint.

Type: text

CWE ID: N/A

Description: The impact of this vulnerability includes the theoretical possibility that an attacker could gain access to all scopes defined for a given customer endpoint.

Metrics

Version	Base score	Base severity	Vector
3.0	6.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Version: 3.0

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Solutions

TIBCO has released updated versions of the affected systems which address these issues. TIBCO API Exchange Gateway versions 2.3.1 and below update to version 2.3.2 or higher TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and below update to version 2.3.2 or higher

References

Hyperlink	Resource
http://www.tibco.com/services/support/advisories	x_refsource_MISC
https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange	x_refsource_CONFIRM

Hyperlink: http://www.tibco.com/services/support/advisories

Resource:

x_refsource_MISC

Hyperlink: https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.tibco.com/services/support/advisories	x_refsource_MISC x_transferred
https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange	x_refsource_CONFIRM x_transferred

Hyperlink: http://www.tibco.com/services/support/advisories

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@tibco.com

Published At:08 Aug, 2019 | 16:15

Updated At:29 Mar, 2023 | 16:20

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Secondary	3.0	6.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.9

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 6.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:*

>>api_exchange_gateway>>Versions up to 2.3.1(inclusive)

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:silver_fabric:*:*

>>api_exchange_gateway>>Versions up to 2.3.1(inclusive)

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.tibco.com/services/support/advisories	security@tibco.com	Vendor Advisory
https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange	security@tibco.com	Issue Tracking Vendor Advisory

Hyperlink: http://www.tibco.com/services/support/advisories

Source: security@tibco.com

Resource:

Vendor Advisory

Hyperlink: https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange

Source: security@tibco.com

Resource:

Issue Tracking

Vendor Advisory

Similar CVEs

12Records found

CVE-2017-5531

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-8||HIGH

EPSS-0.55% / 66.88%

7 Day CHG~0.00%

Published-17 Oct, 2017 | 20:00

Updated-20 Apr, 2025 | 01:37

Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions 8.0.0 and 8.0.1 that enable the Administrator Service may be affected by a vulnerability which may allow any authenticated user to gain administrative control of Managed File Transfer web applications.

Product-managed_file_transfer_command_center managed_file_transfer_internet_server TIBCO Managed File Transfer Command Center TIBCO Managed File Transfer Internet Server

CVE-2021-43054

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-7.1||HIGH

EPSS-0.16% / 37.29%

7 Day CHG~0.00%

Published-11 Jan, 2022 | 18:25

Updated-17 Sep, 2024 | 02:11

TIBCO eFTL Token Generation Vulnerability

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.

Product-eftl TIBCO eFTL - Community Edition TIBCO eFTL - Developer Edition TIBCO eFTL - Enterprise Edition

CVE-2021-43055

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-5.9||MEDIUM

EPSS-0.16% / 37.29%

7 Day CHG~0.00%

Published-11 Jan, 2022 | 18:25

Updated-16 Sep, 2024 | 20:03

TIBCO eFTL Token Caching Vulnerability

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.

Product-eftl TIBCO eFTL - Community Edition TIBCO eFTL - Developer Edition TIBCO eFTL - Enterprise Edition

CVE-2013-3315

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.54% / 66.59%

7 Day CHG~0.00%

Published-31 May, 2013 | 21:00

Updated-11 Apr, 2025 | 00:51

The server in TIBCO Silver Mobile 1.1.0 does not properly verify access to the administrator role before executing a command, which allows authenticated users to gain privileges via unspecified vectors.

Vendor-n/a TIBCO (Cloud Software Group, Inc.)

Product-silver_mobile n/a

CVE-2024-3330

Matching Score-8

Assigner-TIBCO Software Inc.

Vendor-TIBCO (Cloud Software Group, Inc.)Spotfire (Cloud Software Group, Inc.)

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-9.9||CRITICAL

EPSS-0.32% / 53.98%

7 Day CHG~0.00%

Published-27 Jun, 2024 | 18:37

Updated-01 Aug, 2024 | 20:05

Spotfire Remote Code Execution Vulnerability

Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.

Product-Spotfire Analyst Spotfire Server Spotfire for AWS Marketplace spotfire_analyst spotfire_server spotfire_analytics_platform_for_aws

CWE ID-CWE-250

Execution with Unnecessary Privileges

CVE-2021-28828

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-7.6||HIGH

EPSS-0.39% / 58.99%

7 Day CHG~0.00%

Published-20 Apr, 2021 | 18:30

Updated-16 Sep, 2024 | 18:54

TIBCO Administrator SQL injection vulnerability

The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a SQL injection attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1.

Product-administrator TIBCO Administrator - Enterprise Edition TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric TIBCO Administrator - Enterprise Edition for z/Linux

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2020-9417

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-7.6||HIGH

EPSS-0.42% / 61.01%

7 Day CHG~0.00%

Published-20 Oct, 2020 | 21:13

Updated-17 Sep, 2024 | 03:02

TIBCO Foresight SQL Injection

The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.

Product-foresight_transaction_insight foresight_archive_and_retrieval_system foresight_operational_monitor TIBCO Foresight Operational Monitor Healthcare Edition TIBCO Foresight Transaction Insight TIBCO Foresight Archive and Retrieval System TIBCO Foresight Transaction Insight Healthcare Edition TIBCO Foresight Operational Monitor TIBCO Foresight Archive and Retrieval System Healthcare Edition

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2019-11209

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-8.8||HIGH

EPSS-0.54% / 66.47%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 17:23

Updated-16 Sep, 2024 | 22:50

TIBCO FTL Escalation Of Privileges for Realm Configuration

The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition 6.0.0; 6.0.1; 6.1.0, TIBCO FTL Developer Edition 6.0.1; 6.1.0, and TIBCO FTL Enterprise Edition 6.0.0; 6.0.1; 6.1.0.

Product-ftl TIBCO FTL Community Edition TIBCO FTL Developer Edition TIBCO FTL Enterprise Edition

CVE-2018-5429

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-8.8||HIGH

EPSS-0.99% / 75.94%

7 Day CHG~0.00%

Published-17 Apr, 2018 | 18:00

Updated-17 Sep, 2024 | 00:32

TIBCO JasperReports Library Code Sandboxing Problem

A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow analytic reports that contain scripting to perform arbitrary code execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO JasperReports Library: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library Community Edition: versions up to and including 6.4.3, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM: versions up to and including 6.4.2.

Product-jasperreports_library jaspersoft_studio jasperreports_server jaspersoft_reporting_and_analytics jaspersoft TIBCO Jaspersoft Studio TIBCO Jaspersoft Studio for ActiveMatrix BPM TIBCO JasperReports Library Community Edition TIBCO Jaspersoft Reporting and Analytics for AWS TIBCO JasperReports Library for ActiveMatrix BPM TIBCO Jaspersoft for AWS with Multi-Tenancy TIBCO Jaspersoft Studio Community Edition TIBCO JasperReports Library TIBCO JasperReports Server Community Edition TIBCO JasperReports Server for ActiveMatrix BPM TIBCO JasperReports Server

CVE-2016-3628

Matching Score-8

Assigner-MITRE Corporation

Product-enterprise_message_service_appliance_firmware enterprise_message_service_appliance enterprise_message_service n/a

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-2.86% / 85.73%

7 Day CHG~0.00%

Published-20 Apr, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.

Vendor-n/a TIBCO (Cloud Software Group, Inc.)

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-11211

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-9.9||CRITICAL

EPSS-3.13% / 86.34%

7 Day CHG~0.00%

Published-18 Sep, 2019 | 22:21

Updated-17 Sep, 2024 | 03:34

TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code Execution

The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.

Product-enterprise_runtime_for_r spotfire_analytics_platform_for_aws TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Enterprise Runtime for R - Server Edition

CVE-2019-8992

Matching Score-8

Assigner-TIBCO Software Inc.

Matching Score-8

Assigner-TIBCO Software Inc.

CVSS Score-9.9||CRITICAL

EPSS-0.72% / 71.48%

7 Day CHG~0.00%

Published-24 Apr, 2019 | 20:20

Updated-17 Sep, 2024 | 03:23

TIBCO Active Matrix Service Grid Administrator Remote Code Execution

The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability wherein a user without privileges to upload distributed application archives ("Upload DAA" permission) can theoretically upload arbitrary code, and in some circumstances then execute that code on ActiveMatrix Service Grid nodes. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.