SB2022021605 - Multiple vulnerabilities in TIBCO BusinessConnect Container Edition

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-43050)

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Auth Server component. A local attacker can obtain administrative usernames and passwords and obtain full administrative access to the components of the affected system.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-43049)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Database component. A remote attacker can obtain the usernames and passwords of users and gain full administrative access to the affected system.

Remediation

Install update from vendor's website.

References

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-february-15-2022-tibco-bcce-2021-43050
• https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-february-15-2022-tibco-bcce-2021-43049