CVE-2018-12408

TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability

High · published August 8, 2018

CVSS v3.0
7.5
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02347 · 83.5th percentile
Published
2018-08-08T14:00Z
EPSS history
Timeline
  • 08 AUG 14:00Z
    TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
    cvelistv5