« Volver al listado

CVE-2024-10218

Estado: AplazadaCrítica (9.2)—

XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS en interfaz web (CWE-611) con acceso autenticado remoto (AV:N, PR:H). Exploración de datos del servidor (T1005) y posible ejecución de JavaScript (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUser TrainingPrivileged Account ManagementLimit Software InstallationExecution PreventionBehavior Prevention on Endpoint

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tibco Software INC — Tibco HawkAITibco Software INC — Tibco Operational IntelligenceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10218",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10218",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-12T20:34:41.505582Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "security@tibco.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 9.2,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:X/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "security@tibco.com",
      "affectedData": [
        {
          "vendor": "TIBCO Software Inc",
          "modules": [
            "Monitoring Archive Utility (MAR Utility)",
            "monitoringconsolecommon.jar"
          ],
          "product": "TIBCO Hawk",
          "versions": [
            {
              "status": "affected",
              "version": "6.2",
              "lessThan": "5",
              "versionType": "Patch"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "TIBCO Software Inc",
          "modules": [
            "Monitoring Archive Utility (MAR Utility)",
            "monitoringconsolecommon.jar"
          ],
          "product": "TIBCO Operational Intelligence",
          "versions": [
            {
              "status": "affected",
              "version": "7.3",
              "lessThan": "0",
              "versionType": "Patch"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-12T20:15:05.913",
  "references": [
    {
      "url": "https://community.tibco.com/advisories",
      "source": "security@tibco.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence"
    },
    {
      "lang": "es",
      "value": "Ataque XSS en mar.jar, utilidad de archivo de monitoreo (utilidad MAR), monitoringconsolecommon.jar en TIBCO Software Inc TIBCO Hawk y TIBCO Operational Intelligence"
    }
  ],
  "lastModified": "2026-06-17T06:55:10.867",
  "sourceIdentifier": "security@tibco.com"
}