TIBCO takes its security responsibilities very seriously. This page provides information about TIBCO security and how customers or security researchers can contact TIBCO to report or ask about a security issue.
TIBCO Security Advisory: August 7, 2018 - TIBCO ActiveMatrix BusinessWorks
TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
Original release date: August 7, 2018
Last revised: August 31, 2018
Source: TIBCO Software Inc.
- TIBCO ActiveMatrix BusinessWorks versions 5.13.0 and below
- TIBCO ActiveMatrix BusinessWorks for z/Linux versions 5.13.0 and below
- TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions 5.13.0 and below
The following components are affected:
- BusinessWorks engine
The component listed above contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming networks messages, and may disclose the contents of files accessible to a running BusinessWorks engine.
The impact of this vulnerability includes the theoretical possibility of an unauthenticated user gaining access to sensitive information that is available to the system account hosting the BusinessWorks engine.
CVSS v3 Base Score: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
TIBCO has released updated versions of the affected components which address these issues.
For each affected system, update to the corresponding software versions:
- TIBCO ActiveMatrix BusinessWorks versions 5.13.0 and below update to version 5.13.1 or higher
- TIBCO ActiveMatrix BusinessWorks for z/Linux versions 5.13.0 and below update to version 5.13.1 or higher
- TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions 5.13.0 and below update to version 5.13.1 or higher