Information disclosure in TIBCO Data Virtualization

1) Information disclosure

EUVDB-ID: #VU45761

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9415

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to unspecified error within TIBCO Data Virtualization Server component. A remote authenticated user can download arbitrary file from the system. The user must be authenticated and have privileges required to monitor the server in an operational capacity.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Data Virtualization: 7.0.6 - 8.2.0

Data Virtualization for AWS Marketplace: 8.1.0 - 8.2.0

External links

http://www.tibco.com/support/advisories/2020/08/tibco-security-advisory-august-18-2020-tibco-data-virtualization

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.