What is CVE-2023-26217?

CVE-2023-26217 is a high-severity vulnerability in Tibco Ebx Add-Ons, classified under SQL Injection. CVSS score: 8.8/10. Published 2023-07-19.

How severe is CVE-2023-26217?

High severity. CVSS v3 base score is 8.8 out of 10.

SQL Injection in Tibco Ebx Add-Ons

CVE-2023-26217

The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.

Vulnerability class: SQL Injection

EPSS: 0.007 (50.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tibco Ebx_add-ons — versions 6.1.0
Tibco Software Inc. Ebx Add-ons — versions 0, 6.1.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

security@tibco.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-26217?: CVE-2023-26217 is a high-severity vulnerability in Tibco Ebx Add-Ons, classified under SQL Injection. CVSS score: 8.8/10. Published 2023-07-19.
How severe is CVE-2023-26217?: High severity. CVSS v3 base score is 8.8 out of 10.