Lucene search

[email protected]CVE-2020-9417

HistoryOct 20, 2020 - 9:15 p.m.

CVE-2020-9417

2020-10-2021:15:13

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-9417

sql injection

tibco foresight

transaction insight

healthcare edition

vulnerability

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.2%

JSON

The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.

Affected configurations

NVD

Node

tibcoforesight_archive_and_retrieval_systemRange≤5.1.0

tibcoforesight_archive_and_retrieval_systemMatch5.2.0

tibcoforesight_operational_monitorRange≤5.1.0

tibcoforesight_operational_monitorMatch5.2.0

tibcoforesight_transaction_insightRange≤5.1.0

tibcoforesight_transaction_insightMatch5.2.0

Node

tibcoforesight_archive_and_retrieval_systemRange≤5.1.0healthcare

tibcoforesight_archive_and_retrieval_systemMatch5.2.0healthcare

tibcoforesight_operational_monitorRange≤5.1.0healthcare

tibcoforesight_operational_monitorMatch5.2.0healthcare

tibcoforesight_transaction_insightRange≤5.1.0healthcare

tibcoforesight_transaction_insightMatch5.2.0healthcare

CPENameOperatorVersion
tibco:foresight_archive_and_retrieval_systemtibco foresight archive and retrieval systemle5.1.0
tibco:foresight_archive_and_retrieval_systemtibco foresight archive and retrieval systemeq5.2.0
tibco:foresight_operational_monitortibco foresight operational monitorle5.1.0
tibco:foresight_operational_monitortibco foresight operational monitoreq5.2.0
tibco:foresight_transaction_insighttibco foresight transaction insightle5.1.0
tibco:foresight_transaction_insighttibco foresight transaction insighteq5.2.0

CPE	Name	Operator	Version
tibco:foresight_archive_and_retrieval_system	tibco foresight archive and retrieval system	le	5.1.0
tibco:foresight_archive_and_retrieval_system	tibco foresight archive and retrieval system	eq	5.2.0
tibco:foresight_operational_monitor	tibco foresight operational monitor	le	5.1.0
tibco:foresight_operational_monitor	tibco foresight operational monitor	eq	5.2.0
tibco:foresight_transaction_insight	tibco foresight transaction insight	le	5.1.0
tibco:foresight_transaction_insight	tibco foresight transaction insight	eq	5.2.0

CNA Affected

[
  {
    "product": "TIBCO Foresight Archive and Retrieval System",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  },
  {
    "product": "TIBCO Foresight Archive and Retrieval System Healthcare Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  },
  {
    "product": "TIBCO Foresight Operational Monitor",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  },
  {
    "product": "TIBCO Foresight Operational Monitor Healthcare Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  },
  {
    "product": "TIBCO Foresight Transaction Insight",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  },
  {
    "product": "TIBCO Foresight Transaction Insight Healthcare Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "5.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.2.0"
      }
    ]
  }
]

References

www.tibco.com/services/support/advisories

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.2%

JSON

Related for CVE-2020-9417

prion1 tibco1 cvelist1 nvd1