XSS in Tibco Activematrix Bpm
CVE-2019-8991
The administrator web interface of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains multiple vulnerabilities that may allow for cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Tibco Activematrix Bpm
- Tibco Activematrix Policy Director
- Tibco Activematrix Service Bus
- Tibco Activematrix Service Grid
- Tibco Silver Fabric Enabler
- Tibco Software Inc. Activematrix Bpm — versions unspecified
- Tibco Software Inc. Activematrix Bpm Distribution For Silver Fabric — versions unspecified
- Tibco Software Inc. Activematrix Policy Director — versions unspecified
- Tibco Software Inc. Activematrix Service Bus — versions unspecified
- Tibco Software Inc. Activematrix Service Grid — versions unspecified
Weakness classification (CWE)
References
- www.tibco.com/services/support/advisories (Vendor Advisory)
- www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-… (Vendor Advisory)
- www.securityfocus.com/bid/108059 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
Frequently asked questions
- What is CVE-2019-8991?
- CVE-2019-8991 is a high-severity vulnerability in Tibco Activematrix Bpm, classified under Cross-site Scripting. CVSS score: 8.8/10. Published 2019-04-24.
- How severe is CVE-2019-8991?
- High severity. CVSS v3 base score is 8.8 out of 10.