Auth bypass in Tibco Activematrix Businessworks
CVE-2019-8990
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
Vulnerability class: Broken Authentication
EPSS: 0.029 (85.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tibco Activematrix_businessworks
- Tibco Software Inc. Activematrix Businessworks — versions unspecified
Weakness classification (CWE)
References
- security@tibco.com (x_refsource_MISC, Vendor Advisory)
- security@tibco.com (x_refsource_MISC, Vendor Advisory)
- security@tibco.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-8990?
- CVE-2019-8990 is a high-severity vulnerability in Tibco Activematrix Businessworks, classified under Improper Authentication. CVSS score: 8.1/10. Published 2019-04-09.
- How severe is CVE-2019-8990?
- High severity. CVSS v3 base score is 8.1 out of 10.