Main Vulnerability Database Vulnerabilities #VU58224

Permissions, Privileges, and Access Controls in TIBCO PartnerExpress - CVE-2021-43046

Published: November 18, 2021

Vulnerability identifier: #VU58224

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-43046

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Interior Server and Gateway Server components, which leads to security restrictions bypass and privilege escalation.

Affected software

TIBCO PartnerExpress

How to mitigate CVE-2021-43046

Install updates from vendor's website.

TIBCO PartnerExpress - update to 6.2.2

External References

https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2021/11/tibco-security-advisory-november-16-2021-tibco-partnerexpress-2021-43046

Related Security Bulletins