Information disclosure in Data Virtualization and Data Virtualization for AWS Marketplace - CVE-2020-9415

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU45761

Information disclosure in Data Virtualization and Data Virtualization for AWS Marketplace - CVE-2020-9415

Published: August 19, 2020


Vulnerability identifier: #VU45761
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-9415
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to unspecified error within TIBCO Data Virtualization Server component. A remote authenticated user can download arbitrary file from the system. The user must be authenticated and have privileges required to monitor the server in an operational capacity.


Affected software

Data Virtualization
Data Virtualization for AWS Marketplace

How to mitigate CVE-2020-9415

Install updates from vendor's website.

Data Virtualization - addressed in versions 7.0.9, 8.3.0
Data Virtualization for AWS Marketplace - update to 8.3.0

External References

Related Security Bulletins