Cross-site request forgery in TIBCO products - CVE-2019-8991

Vulnerability identifier: #VU21223

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2019-8991

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: TIBCO

Affected software:
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
TIBCO Silver Fabric Enabler for ActiveMatrix BPM
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Service Grid
TIBCO ActiveMatrix Service Bus
TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Policy Director
TIBCO ActiveMatrix BPM

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the administrator web interface component. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Install update from vendor's website.

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8991