Vulnerability · Published Oct 13, 2021 · Assigned by tibco
CVE-2021-35498TIBCO EBX Insecure Login Mechanism
Critical 9.8
In plain English
A critical-severity security flaw in TIBCO EBX from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Official description
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TIBCO Software Inc. | TIBCO EBX | unspecified – through 5.8.123 |
| TIBCO Software Inc. | TIBCO EBX | 5.9.35.9.45.9.55.9.65.9.75.9.85.9.95.9.10 |
| TIBCO Software Inc. | TIBCO EBX | 6.0.06.0.1 |
| TIBCO Software Inc. | TIBCO Product and Service Catalog powered by TIBCO EBX | 1.0.0 |
References
- https://www.tibco.com/services/support/advisories x_refsource_CONFIRM
- https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-13-2021-tibco-ebx-2021-35498 x_refsource_CONFIRM