Information disclosure in Data Virtualization and Data Virtualization for AWS Marketplace - CVE-2020-9415
Published: August 19, 2020
Vulnerability identifier: #VU45761
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-9415
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: TIBCO
Affected software:
Data Virtualization
Data Virtualization for AWS Marketplace
Data Virtualization
Data Virtualization for AWS Marketplace
Detailed vulnerability description
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to unspecified error within TIBCO Data Virtualization Server component. A remote authenticated user can download arbitrary file from the system. The user must be authenticated and have privileges required to monitor the server in an operational capacity.
How to mitigate CVE-2020-9415
Install updates from vendor's website.