Vulnerability · Published Jan 12, 2022 · Assigned by tibco
CVE-2021-35500TIBCO Data Virtualization Arbitrary File Download vulnerability
Medium 6.3
In plain English
A medium-severity security flaw in TIBCO Data Virtualization from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TIBCO Software Inc. | TIBCO Data Virtualization | unspecified – through 8.3.0 |
| TIBCO Software Inc. | TIBCO Data Virtualization | 8.4.0 |
| TIBCO Software Inc. | TIBCO Data Virtualization | 8.5.0 |
| TIBCO Software Inc. | TIBCO Data Virtualization for AWS Marketplace | unspecified – through 8.5.0 |