Multiple vulnerabilities in TIBCO LogLogic Log Management Intelligence

Published: 2019-08-13 | Updated: 2019-08-22

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2019-11207
CWE-ID	CWE-79 CWE-352
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	TIBCO LogLogic ST4035 Appliance Server applications / Virtualization software TIBCO LogLogic ST4025R2 Appliance Server applications / Virtualization software TIBCO LogLogic ST4025R1 Appliance Server applications / Virtualization software TIBCO LogLogic ST2035-SAN Appliance Server applications / Virtualization software TIBCO LogLogic ST2025-SANR2 Appliance Server applications / Virtualization software TIBCO LogLogic ST2025-SANR1 Appliance Server applications / Virtualization software TIBCO LogLogic LX4035 Appliance Server applications / Virtualization software TIBCO LogLogic LX4025R2 Appliance Server applications / Virtualization software TIBCO LogLogic LX4025R1 Appliance Server applications / Virtualization software TIBCO LogLogic LX1025R2 Appliance Server applications / Virtualization software TIBCO LogLogic LX1025R1 Appliance Server applications / Virtualization software TIBCO LogLogic LX1035 Appliance Server applications / Virtualization software TIBCO LogLogic ST4025 Appliance Server applications / Virtualization software TIBCO LogLogic ST2025-SAN Appliance Server applications / Virtualization software TIBCO LogLogic ST1025 Appliance Server applications / Virtualization software TIBCO LogLogic MX4025 Appliance Server applications / Virtualization software TIBCO LogLogic MX3025 Appliance Server applications / Virtualization software TIBCO LogLogic LX4025 Appliance Server applications / Virtualization software TIBCO LogLogic LX1025 Appliance Server applications / Virtualization software TIBCO LogLogic LX825 Appliance Server applications / Virtualization software TIBCO LogLogic Log Management Intelligence Server applications / Virtualization software TIBCO LogLogic Enterprise Virtual Appliance Server applications / Virtualization software
Vendor	TIBCO

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Reflected cross-site scripting

EUVDB-ID: #VU20358

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and perform administrative functions provided by the web interface of the affected component.

Mitigation

Install update from vendor's website.

Vulnerable software versions

TIBCO LogLogic ST4035 Appliance: 0.0.005

TIBCO LogLogic ST4025R2 Appliance: 0.0.004

TIBCO LogLogic ST4025R1 Appliance: 0.0.004

TIBCO LogLogic ST2035-SAN Appliance: 0.0.005

TIBCO LogLogic ST2025-SANR2 Appliance: 0.0.004

TIBCO LogLogic ST2025-SANR1 Appliance: 0.0.004

TIBCO LogLogic LX4035 Appliance: 0.0.005

TIBCO LogLogic LX4025R2 Appliance: 0.0.004

TIBCO LogLogic LX4025R1 Appliance: 0.0.004

TIBCO LogLogic LX1025R2 Appliance: 0.0.004

TIBCO LogLogic LX1025R1 Appliance: 0.0.004

TIBCO LogLogic LX1035 Appliance: 0.0.005

TIBCO LogLogic ST4025 Appliance: 0.0.004

TIBCO LogLogic ST2025-SAN Appliance: 0.0.004

TIBCO LogLogic ST1025 Appliance: 0.0.004

TIBCO LogLogic MX4025 Appliance: 0.0.004

TIBCO LogLogic MX3025 Appliance: 0.0.004

TIBCO LogLogic LX4025 Appliance: 0.0.004

TIBCO LogLogic LX1025 Appliance: 0.0.004

TIBCO LogLogic LX825 Appliance: 0.0.004

TIBCO LogLogic Log Management Intelligence: 6.2.1

TIBCO LogLogic Enterprise Virtual Appliance: 6.2.1

External links

http://www.tibco.com/services/support/advisories
http://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-13-2019-tibco-loglogic-log-management-intelligence

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site request forgery

EUVDB-ID: #VU20357