CVE-2020-9415

TIBCO Data Virtualization

CVSS 5.3 MEDIUMEPSS 0.8%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

18 Aug 2020Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user must be authenticated and have privileges required to monitor the server in an operational capacity. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 7.0.8 and below, versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 and TIBCO Data Virtualization for AWS Marketplace: versions 8.2.0 and below.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

TIBCO Software Inc. · TIBCO Data Virtualization TIBCO Software Inc. · TIBCO Data Virtualization for AWS Marketplace

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.tibco.com/support/advisories/2020/08/tibco-security-advisory-august-18-2020-tibco-data-virtualization http://www.tibco.com/services/support/advisories