Cross-site scripting in TIBCO products - CVE-2019-8991

Vulnerability identifier: #VU21229

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2019-8991

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the administrator web interface component. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric
TIBCO Silver Fabric Enabler for ActiveMatrix BPM
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid
TIBCO ActiveMatrix Service Bus
TIBCO ActiveMatrix Service Grid
TIBCO ActiveMatrix Policy Director
TIBCO ActiveMatrix BPM

Install update from vendor's website.

TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric - update to 4.3.0
TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric - update to 3.4.0
TIBCO Silver Fabric Enabler for ActiveMatrix BPM - update to 1.4.2
TIBCO ActiveMatrix Policy Director - update to 2.0.0
TIBCO ActiveMatrix BPM - update to 4.3.0
TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid - update to 1.3.2
TIBCO ActiveMatrix Service Bus - update to 3.4.0
TIBCO ActiveMatrix Service Grid - update to 3.4.0

• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-tibco-active-matrix-service-grid-2019-8991

• Multiple vulnerabilities in TIBCO products