Arbitrary file upload in TIBCO products - CVE-2019-8992

Vulnerability identifier: #VU21226

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-8992

CWE-ID: CWE-434

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file uploads in the administrative server component. A remote authenticated attacker without privileges to upload distributed application archives ("Upload DAA" permission) can upload and execute arbitrary code on ActiveMatrix Service Grid nodes.

TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
TIBCO Silver Fabric Enabler for ActiveMatrix BPM
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
TIBCO ActiveMatrix Service Bus
TIBCO ActiveMatrix Service Grid
TIBCO ActiveMatrix Policy Director
TIBCO ActiveMatrix BPM

Install updates from vendor's website.

TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric - update to 4.3.0
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric - update to 3.4.0
TIBCO Silver Fabric Enabler for ActiveMatrix BPM - update to 1.4.2
TIBCO ActiveMatrix Policy Director - update to 2.0.0
TIBCO ActiveMatrix BPM - update to 4.3.0
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid - update to 1.3.2
TIBCO ActiveMatrix Service Bus - update to 3.4.0
TIBCO ActiveMatrix Service Grid - update to 3.4.0

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8992

• Multiple vulnerabilities in TIBCO products