Arbitrary file upload in Tibco Activematrix Bpm
CVE-2019-8992
The administrative server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability wherein a user without privileges to upload distributed application archives ("Upload DAA" permission) can theoretically upload arbitrary code, and in some circumstances then execute that code on ActiveMatrix Service Grid nodes. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Vulnerability class: Unrestricted File Upload
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (81.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Tibco Activematrix Bpm
- Tibco Activematrix Policy Director
- Tibco Activematrix Service Bus
- Tibco Activematrix Service Grid
- Tibco Silver Fabric Enabler
- Tibco Software Inc. Activematrix Bpm — versions unspecified
- Tibco Software Inc. Activematrix Bpm Distribution For Silver Fabric — versions unspecified
- Tibco Software Inc. Activematrix Policy Director — versions unspecified
- Tibco Software Inc. Activematrix Service Bus — versions unspecified
- Tibco Software Inc. Activematrix Service Grid — versions unspecified
Weakness classification (CWE)
References
- www.tibco.com/services/support/advisories (Vendor Advisory)
- www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-… (Vendor Advisory)
- www.securityfocus.com/bid/108058 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
Frequently asked questions
- What is CVE-2019-8992?
- CVE-2019-8992 is a high-severity vulnerability in Tibco Activematrix Bpm, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2019-04-24.
- How severe is CVE-2019-8992?
- High severity. CVSS v3 base score is 8.8 out of 10.