Lucene search

[email protected]CVE-2018-12411

HistoryNov 06, 2018 - 11:29 p.m.

CVE-2018-12411

2018-11-0623:29:00

CWE-352

[email protected]

web.nvd.nist.gov

cve

2018

12411

cross-site request forgery

tibco

activespaces

community edition

developer edition

enterprise edition

security vulnerability

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.0%

JSON

The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: 3.3.0; 3.4.0; 3.5.0, TIBCO ActiveSpaces - Developer Edition: 3.0.0; 3.1.0; 3.3.0; 3.4.0; 3.5.0, and TIBCO ActiveSpaces - Enterprise Edition: 3.0.0; 3.1.0; 3.2.0; 3.3.0; 3.4.0; 3.5.0.

Affected configurations

NVD

Node

tibcoactivespacesMatch3.0.0developer

tibcoactivespacesMatch3.0.0enterprise

tibcoactivespacesMatch3.1.0developer

tibcoactivespacesMatch3.1.0enterprise

tibcoactivespacesMatch3.2.0enterprise

tibcoactivespacesMatch3.3.0community

tibcoactivespacesMatch3.3.0developer

tibcoactivespacesMatch3.3.0enterprise

tibcoactivespacesMatch3.4.0community

tibcoactivespacesMatch3.4.0developer

tibcoactivespacesMatch3.4.0enterprise

tibcoactivespacesMatch3.5.0community

tibcoactivespacesMatch3.5.0developer

tibcoactivespacesMatch3.5.0enterprise

CPENameOperatorVersion
tibco:activespacestibco activespaceseq3.0.0
tibco:activespacestibco activespaceseq3.1.0
tibco:activespacestibco activespaceseq3.2.0
tibco:activespacestibco activespaceseq3.3.0
tibco:activespacestibco activespaceseq3.4.0
tibco:activespacestibco activespaceseq3.5.0

CPE	Name	Operator	Version
tibco:activespaces	tibco activespaces	eq	3.0.0
tibco:activespaces	tibco activespaces	eq	3.1.0
tibco:activespaces	tibco activespaces	eq	3.2.0
tibco:activespaces	tibco activespaces	eq	3.3.0
tibco:activespaces	tibco activespaces	eq	3.4.0
tibco:activespaces	tibco activespaces	eq	3.5.0

CNA Affected

[
  {
    "product": "TIBCO ActiveSpaces - Community Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "3.3.0"
      },
      {
        "status": "affected",
        "version": "3.4.0"
      },
      {
        "status": "affected",
        "version": "3.5.0"
      }
    ]
  },
  {
    "product": "TIBCO ActiveSpaces - Developer Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0"
      },
      {
        "status": "affected",
        "version": "3.1.0"
      },
      {
        "status": "affected",
        "version": "3.3.0"
      },
      {
        "status": "affected",
        "version": "3.4.0"
      },
      {
        "status": "affected",
        "version": "3.5.0"
      }
    ]
  },
  {
    "product": "TIBCO ActiveSpaces - Enterprise Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0"
      },
      {
        "status": "affected",
        "version": "3.1.0"
      },
      {
        "status": "affected",
        "version": "3.2.0"
      },
      {
        "status": "affected",
        "version": "3.3.0"
      },
      {
        "status": "affected",
        "version": "3.4.0"
      },
      {
        "status": "affected",
        "version": "3.5.0"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105869

www.tibco.com/services/support/advisories

www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-activespaces

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.0%

JSON

Related for CVE-2018-12411

tibco2 prion1 cvelist1 nvd1