Information disclosure in TIBCO products - CVE-2019-8993

Vulnerability identifier: #VU21222

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2019-8993

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: TIBCO

Affected software:
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
TIBCO Silver Fabric Enabler for ActiveMatrix BPM
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Service Grid
TIBCO ActiveMatrix Service Bus
TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Policy Director
TIBCO ActiveMatrix BPM

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to unspecified error in the administrative web server component. A remote attacker can download a file with credentials information.

Install updates from vendor's website.

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8993