Auth bypass in Tibco Activematrix Bpm
CVE-2019-8993
The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.025 (84.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.025 · newest: 0.025 · change: 0.000
Affected products
- Tibco Activematrix Bpm
- Tibco Activematrix Policy Director
- Tibco Activematrix Service Bus
- Tibco Activematrix Service Grid
- Tibco Silver Fabric Enabler
- Tibco Software Inc. Activematrix Bpm — versions unspecified
- Tibco Software Inc. Activematrix Bpm Distribution For Silver Fabric — versions unspecified
- Tibco Software Inc. Activematrix Policy Director — versions unspecified
- Tibco Software Inc. Activematrix Service Bus — versions unspecified
- Tibco Software Inc. Activematrix Service Grid — versions unspecified
Weakness classification (CWE)
References
- www.tibco.com/services/support/advisories (Vendor Advisory)
- www.tibco.com/support/advisories/2019/04/tibco-security-advisory-april-24-2019-… (Vendor Advisory)
- www.securityfocus.com/bid/108056 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
Frequently asked questions
- What is CVE-2019-8993?
- CVE-2019-8993 is a critical-severity vulnerability in Tibco Activematrix Bpm, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2019-04-24.
- How severe is CVE-2019-8993?
- Critical severity. CVSS v3 base score is 9.8 out of 10.