Information disclosure in TIBCO products - CVE-2021-43053
Published: January 12, 2022
Vulnerability identifier: #VU59538
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-43053
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the Realm Server component. A remote authenticated attacker can obtain cluster secret of another application connected to the realm server.
Affected software
TIBCO FTL Community Edition
TIBCO FTL Developer Edition
TIBCO FTL Enterprise Edition
TIBCO FTL Developer Edition
TIBCO FTL Enterprise Edition
How to mitigate CVE-2021-43053
Install updates from vendor's website.
TIBCO FTL Community Edition - update to 6.7.3
TIBCO FTL Developer Edition - update to 6.7.3
TIBCO FTL Enterprise Edition - update to 6.7.3
TIBCO FTL Developer Edition - update to 6.7.3
TIBCO FTL Enterprise Edition - update to 6.7.3