ByteOS Network

NVD Vulnerability Details :

CVE-2019-11208

Analyzed

Source-security@tibco.com

Published At-08 Aug, 2019 | 16:15

Updated At-29 Mar, 2023 | 16:20

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Secondary	3.0	6.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

TIBCO (Cloud Software Group, Inc.)

>>api_exchange_gateway>>Versions up to 2.3.1(inclusive)

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:*

TIBCO (Cloud Software Group, Inc.)

>>api_exchange_gateway>>Versions up to 2.3.1(inclusive)

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:silver_fabric:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.tibco.com/services/support/advisories	security@tibco.com	Vendor Advisory
https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange	security@tibco.com	Issue Tracking Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History