CVE-2019-17330

moderate-risk
Published 2019-11-12

The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.

Do I need to act?

-
0.25% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.6/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Ebx
Ebx
Ebx
Ebx
Ebx
Ebx

Affected Vendors

Tibco

References (4)

Issue Tracking http://www.tibco.com/services/support/advisories
Vendor Advisory https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-novembe...
Issue Tracking http://www.tibco.com/services/support/advisories
Vendor Advisory https://www.tibco.com/support/advisories/2019/11/tibco-security-advisory-novembe...
46
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 13/34 · Low