Vulnerability · Published May 17, 2022 · Assigned by tibco

CVE-2022-22775TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability

High 8.1

In plain English

A high-severity security flaw in TIBCO BPM Enterprise from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 55.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.

Affected products (as reported)

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO BPM Enterprise	unspecified – through 4.3.1
TIBCO Software Inc.	TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric	unspecified – through 4.3.1

References

https://www.tibco.com/services/support/advisories x_refsource_CONFIRM
https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-17-2022-tibco-activematrix-bpm-cve-2022-22775 x_refsource_CONFIRM