Reflected cross-site scripting in TIBCO products - #VU20358

Vulnerability identifier: #VU20358

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and perform administrative functions provided by the web interface of the affected component.

TIBCO LogLogic Enterprise Virtual Appliance
TIBCO LogLogic Log Management Intelligence
TIBCO LogLogic ST4025R2 Appliance
TIBCO LogLogic LX825 Appliance
TIBCO LogLogic LX1025 Appliance
TIBCO LogLogic LX4025 Appliance
TIBCO LogLogic MX3025 Appliance
TIBCO LogLogic MX4025 Appliance
TIBCO LogLogic ST1025 Appliance
TIBCO LogLogic ST2025-SAN Appliance
TIBCO LogLogic ST4025 Appliance
TIBCO LogLogic LX1025R1 Appliance
TIBCO LogLogic LX1025R2 Appliance
TIBCO LogLogic LX4025R1 Appliance
TIBCO LogLogic LX4025R2 Appliance
TIBCO LogLogic ST2025-SANR1 Appliance
TIBCO LogLogic ST2025-SANR2 Appliance
TIBCO LogLogic ST4025R1 Appliance
TIBCO LogLogic LX1035 Appliance
TIBCO LogLogic LX4035 Appliance
TIBCO LogLogic ST2035-SAN Appliance
TIBCO LogLogic ST4035 Appliance

Install update from vendor's website.

TIBCO LogLogic Enterprise Virtual Appliance - update to 6.3.0
TIBCO LogLogic Log Management Intelligence - update to 6.3.0
TIBCO LogLogic ST4025R2 Appliance - update to 6.3.0
TIBCO LogLogic LX825 Appliance - update to 6.2.1_02
TIBCO LogLogic LX1025 Appliance - update to 6.2.1_02
TIBCO LogLogic LX4025 Appliance - update to 6.2.1_02
TIBCO LogLogic MX3025 Appliance - update to 6.2.1_02
TIBCO LogLogic MX4025 Appliance - update to 6.2.1_02
TIBCO LogLogic ST1025 Appliance - update to 6.2.1_02
TIBCO LogLogic ST2025-SAN Appliance - update to 6.2.1_02
TIBCO LogLogic ST4025 Appliance - update to 6.2.1_02
TIBCO LogLogic LX1025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX1025R2 Appliance - update to 6.3.0
TIBCO LogLogic LX4025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX4025R2 Appliance - update to 6.3.0
TIBCO LogLogic ST2025-SANR1 Appliance - update to 6.3.0
TIBCO LogLogic ST2025-SANR2 Appliance - update to 6.3.0
TIBCO LogLogic ST4025R1 Appliance - update to 6.3.0
TIBCO LogLogic LX1035 Appliance - update to 6.3.0
TIBCO LogLogic LX4035 Appliance - update to 6.3.0
TIBCO LogLogic ST2035-SAN Appliance - update to 6.3.0
TIBCO LogLogic ST4035 Appliance - update to 6.3.0

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-13-2019-tibco-loglogic-log-management-intelligence

• Multiple vulnerabilities in TIBCO LogLogic Log Management Intelligence