Improper Certificate Validation in TIBCO products - CVE-2021-35497

Vulnerability identifier: #VU57078

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-35497

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper certificate validation in the FTL Server (tibftlserver) and Docker images containing tibftlserver components. A remote authenticated attacker can perform a man-in-the-middle (MitM) attack and gain full administrative access to the affected system.

TIBCO ActiveSpaces Community Edition
TIBCO ActiveSpaces Enterprise Edition
TIBCO ActiveSpaces Developer Edition
TIBCO eFTL Enterprise Edition
TIBCO eFTL Developer Edition
TIBCO eFTL Community Edition
TIBCO FTL Enterprise Edition
TIBCO FTL Developer Edition
TIBCO FTL Community Edition

Install updates from vendor's website.

TIBCO ActiveSpaces Community Edition - update to 4.7.0
TIBCO ActiveSpaces Enterprise Edition - update to 4.7.0
TIBCO ActiveSpaces Developer Edition - update to 4.7.0
TIBCO eFTL Enterprise Edition - update to 6.7.1
TIBCO eFTL Developer Edition - update to 6.7.1
TIBCO eFTL Community Edition - update to 6.7.1
TIBCO FTL Enterprise Edition - update to 6.7.1
TIBCO FTL Developer Edition - update to 6.7.1
TIBCO FTL Community Edition - update to 6.7.1

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-5-2021-tibco-ftl-2021-35497

• Improper Certificate Validation in TIBCO ActiveSpaces, FTL and eFTL