Auth bypass in Tibco Activematrix Businessworks

CVE-2019-8990

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.

Vulnerability class: Broken Authentication

EPSS: 0.029 (85.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2019-8990?
CVE-2019-8990 is a high-severity vulnerability in Tibco Activematrix Businessworks, classified under Improper Authentication. CVSS score: 8.1/10. Published 2019-04-09.
How severe is CVE-2019-8990?
High severity. CVSS v3 base score is 8.1 out of 10.