SB2022011212 - Multiple vulnerabilities in TIBCO eFTL

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2021-43054)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the eFTL Server component. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

2) Information disclosure (CVE-ID: CVE-2021-43055)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in te eFTL Server component. A remote authenticated attacker can gain full access to communication on an existing channel on the affected system.

Remediation

Install update from vendor's website.

References

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43054
• https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-11-2022-tibco-eftl-2021-43055