TIBCO is aware of the recently announced Java Spring Framework vulnerabilities (CVE-2022-22963, CVE-2022-22965, and CVE-2022-22950), with one of them being referred to as “Spring4Shell”. These vulnerabilities potentially enable an attacker to execute arbitrary code by taking advantage of poor data bindings and/or malicious expression language statements.

TIBCO is actively monitoring the still evolving situation and updates with regards to the Java Spring Framework and our Product Security Incident Response Team (PSIRT) is actively evaluating how this vulnerability may affect TIBCO products and cloud services.

TIBCO WebFOCUS Client Releases 8.2.07.28 and 9.0 are not impacted by CVE-2022-22963, CVE-2022-22965, or CVE-2022-22950, when installed with the default configuration (see Resolution section below for default configuration details).

Customers requiring Spring 5.3.18 can download TIBCO WebFOCUS Client Releases 8207.28.10 and 9.0.1 from eDelivery.

Confirm that the default configuration is installed:

• Apache Tomcat
• Java 1.8
• ibi_apps (open deployment)
• ibi_html (war deployment), which does not contain Spring Framework code

1. Open http://server:port/ibi_apps/admin,
   Where server is the name of the server hosting your installation of WebFOCUS, and port is the number of the port connection to that server.
2. Select HTTP Request Info from the Diagnostics pane. If the Application Server is not Apache Tomcat, your testing is complete. Otherwise, continue to the next step.
3. Select JVM Property Info from the Diagnostics pane. If it shows that you are running Java 1.8, your testing is complete. Otherwise, continue to the next step.
4. Open xxx:\ibi\tomcat\conf\Catalina\localhost\ibi_apps.xml. If docBase does not include .war, your testing is complete.

• https://tomcat.apache.org/tomcat-8.5-doc/changelog.html#Tomcat_8.5.78_(markt)
• https://tomcat.apache.org/tomcat-9.0-doc/changelog.html#Tomcat_9.0.62_(remm)
• https://tomcat.apache.org/tomcat-10.0-doc/changelog.html#Tomcat_10.0.20_(markt)

• https://www.tibco.com/support/notices/spring-framework-vulnerability-update

• https://support.tibco.com/s/article/Legacy-ibi-Releases-and-Spring-Framework-Vulnerability