Vulnerability · Published Jan 12, 2021 · Assigned by tibco
CVE-2020-27148TIBCO EBX EXML External Entity
High 7.1
In plain English
A high-severity security flaw in TIBCO EBX Add-ons from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)1.1%top 35.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The TIBCO EBX Add-on for Oracle Hyperion EPM, TIBCO EBX Data Exchange Add-on, and TIBCO EBX Insight Add-on components of TIBCO Software Inc.'s TIBCO EBX Add-ons contain a vulnerability that theoretically allows a low privileged attacker with network access to execute an XML External Entity (XXE) attack. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.4.2 and below.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TIBCO Software Inc. | TIBCO EBX Add-ons | unspecified – through 4.4.2 |
References
- http://www.tibco.com/services/support/advisories x_refsource_CONFIRM
- https://www.tibco.com/support/advisories/2021/01/tibco-security-advisory-january-12-2021-tibco-ebx x_refsource_CONFIRM
- https://www.tibco.com/support/advisories/2021/01/tibco-security-advisory-january-12-2021-tibco-ebx-add-ons x_refsource_CONFIRM