Cross-site request forgery in TIBCO products - CVE-2019-11207

Vulnerability identifier: #VU20357

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11207

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform administrative functions provided by the web interface of the affected component.

TIBCO LogLogic Enterprise Virtual Appliance
TIBCO LogLogic Log Management Intelligence
TIBCO LogLogic ST4025R2 Appliance
TIBCO LogLogic LX825 Appliance
TIBCO LogLogic LX1025 Appliance
TIBCO LogLogic LX4025 Appliance
TIBCO LogLogic MX3025 Appliance
TIBCO LogLogic MX4025 Appliance
TIBCO LogLogic ST1025 Appliance
TIBCO LogLogic ST2025-SAN Appliance
TIBCO LogLogic ST4025 Appliance
TIBCO LogLogic LX1025R1 Appliance
TIBCO LogLogic LX1025R2 Appliance
TIBCO LogLogic LX4025R1 Appliance
TIBCO LogLogic LX4025R2 Appliance
TIBCO LogLogic ST2025-SANR1 Appliance
TIBCO LogLogic ST2025-SANR2 Appliance
TIBCO LogLogic ST4025R1 Appliance
TIBCO LogLogic LX1035 Appliance
TIBCO LogLogic LX4035 Appliance
TIBCO LogLogic ST2035-SAN Appliance
TIBCO LogLogic ST4035 Appliance

Install update from vendor's website.

TIBCO LogLogic Enterprise Virtual Appliance - update to 6.3.0
TIBCO LogLogic Log Management Intelligence - update to 6.3.0
TIBCO LogLogic ST4025R2 Appliance - update to 6.3.0
TIBCO LogLogic LX825 Appliance - update to 6.2.1_02
TIBCO LogLogic LX1025 Appliance - update to 6.2.1_02
TIBCO LogLogic LX4025 Appliance - update to 6.2.1_02
TIBCO LogLogic MX3025 Appliance - update to 6.2.1_02
TIBCO LogLogic MX4025 Appliance - update to 6.2.1_02
TIBCO LogLogic ST1025 Appliance - update to 6.2.1_02
TIBCO LogLogic ST2025-SAN Appliance - update to 6.2.1_02
TIBCO LogLogic ST4025 Appliance - update to 6.2.1_02
TIBCO LogLogic LX1025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX1025R2 Appliance - update to 6.3.0
TIBCO LogLogic LX4025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX4025R2 Appliance - update to 6.3.0
TIBCO LogLogic ST2025-SANR1 Appliance - update to 6.3.0
TIBCO LogLogic ST2025-SANR2 Appliance - update to 6.3.0
TIBCO LogLogic ST4025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX1035 Appliance - update to 6.3.0
TIBCO LogLogic LX4035 Appliance - update to 6.3.0
TIBCO LogLogic ST2035-SAN Appliance - update to 6.3.0
TIBCO LogLogic ST4035 Appliance - update to 6.3.0

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-13-2019-tibco-loglogic-log-management-intelligence

• Multiple vulnerabilities in TIBCO LogLogic Log Management Intelligence