CVE-2021-35497
Published: Oct 5, 2021
Modified: Sep 16, 2024
CVSS v3.1
7.5
Description
The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
| Vendor | Product | Versions |
|---|---|---|
TIBCO Software Inc. | TIBCO ActiveSpaces - Community Edition | affected 4.3.0affected 4.4.0affected 4.5.0affected 4.6.0affected 4.6.1+1 more versions |
TIBCO Software Inc. | TIBCO ActiveSpaces - Developer Edition | affected 4.3.0affected 4.4.0affected 4.5.0affected 4.6.0affected 4.6.1+1 more versions |
TIBCO Software Inc. | TIBCO ActiveSpaces - Enterprise Edition | affected 4.3.0affected 4.4.0affected 4.5.0affected 4.6.0affected 4.6.1+1 more versions |
TIBCO Software Inc. | TIBCO FTL - Community Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
TIBCO Software Inc. | TIBCO FTL - Developer Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
TIBCO Software Inc. | TIBCO FTL - Enterprise Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
TIBCO Software Inc. | TIBCO eFTL - Community Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
TIBCO Software Inc. | TIBCO eFTL - Developer Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
TIBCO Software Inc. | TIBCO eFTL - Enterprise Edition | affected 6.2.0affected 6.3.0affected 6.3.1affected 6.4.0affected 6.5.0+3 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now