Security Advisory regarding TIBCO Managed File Transfer
Article ID: KB0108039
Updated On:
| Products | Versions |
|---|---|
| TIBCO Managed File Transfer Command Center | 8.2.1 and below |
Description
TIBCO Managed File Transfer reflected XSS vulerability
Original release date: June 30, 2020
Last revised: ---
Source: TIBCO Software Inc.
Description
The components listed above contain a vulnerability that theoretically allows
an attacker to craft an URL that will execute arbitrary commands on the
affected system. If the attacker convinces an authenticated user with a
currently active session to enter or click on the URL the commands will be
executed on the affected system.
Impact
The impact of this vulnerability includes the possibility that an attacker can
gain access to the session ID of the affected user's session and take any
action the affected user has privilege to perform.
CVSS v3 Base Score: 6.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Environment
Resolution
issue:
TIBCO Managed File Transfer Command Center versions 8.2.1 and below update
to version 8.3.0 or higher
TIBCO Managed File Transfer Internet Server versions 8.2.1 and below update
to version 8.3.0 or higher
Issue/Introduction
Additional Information
CVE-2020-9413
