« Volver al listado

CVE-2019-17332

Estado: ModificadaMedia (5.4)—

The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, versions 4.1.0, 4.2.0, 4.2.1, and 4.2.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tibco — EBX Add-ons

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-17332",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@tibco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@tibco.com",
      "affectedData": [
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO EBX Add-ons",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "3.20.13"
            },
            {
              "status": "affected",
              "version": "4.1.0"
            },
            {
              "status": "affected",
              "version": "4.2.0"
            },
            {
              "status": "affected",
              "version": "4.2.1"
            },
            {
              "status": "affected",
              "version": "4.2.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-12T20:15:12.263",
  "references": [
    {
      "url": "http://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17332",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "http://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019-17332",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, versions 4.1.0, 4.2.0, 4.2.1, and 4.2.2."
    },
    {
      "lang": "es",
      "value": "El componente Digital Asset Manager Web Interface de los Add-ons TIBCO EBX de TIBCO Software Inc. contiene una vulnerabilidad que teóricamente permite a usuarios autenticados realizar ataques de tipo cross-site scripting (XSS) almacenados. Las versiones afectadas son los  Add-ons TIBCO EBX de TIBCO Software Inc.: versiones hasta 3.20.13 incluyéndola, versiones 4.1.0, 4.2.0, 4.2.1 y 4.2.2."
    }
  ],
  "lastModified": "2026-06-17T02:23:44.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29151D10-336D-4620-BC76-734452A7DD76",
              "versionEndIncluding": "3.20.13"
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB945CC7-B8DB-4954-99CF-5AA3F795556C"
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3466D471-4B75-468D-B14F-53E7B303BA14"
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50366C95-1167-47B6-BE4B-7D8AA1969DEA"
            },
            {
              "criteria": "cpe:2.3:a:tibco:ebx_add-ons:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35564BC3-5F27-4D1A-B0DE-339A623AA8B1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@tibco.com"
}