Vulnerability · Published Jan 26, 2021 · Assigned by tibco

CVE-2021-23272TIBCO BPM Cross Site Scripting (XSS)

Medium 4.6

In plain English

A medium-severity security flaw in TIBCO BPM Enterprise from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.0 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.0 and below.

Affected products (as reported)

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO BPM Enterprise	unspecified – through 4.3.0
TIBCO Software Inc.	TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric	unspecified – through 4.3.0

References

http://www.tibco.com/services/support/advisories x_refsource_CONFIRM