CVE:CVE-2018-12408
CNNVD:CNNVD-201808-251
TIBCO ActiveMatrix BusinessWorks是美国TIBCO软件公司的一套基于业界标准的解决方案。该产品能够与其他ActiveMatrix产品共融，支持用户进行服务创建、编制和整合等。BusinessWorks engine是其中的一个工作流程自动化引擎。
TIBCO ActiveMatrix BusinessWorks中的BusinessWorks engine组件存在XML外部实体注入漏洞。攻击者可利用该漏洞泄露BusinessWorks引擎可访问的文件内容。以下版本受到影响：TIBCO ActiveMatrix BusinessWorks 5.13.0及之前版本，TIBCO ActiveMatrix BusinessWorks for z/Linux 5.13.0及之前版本，TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric 5.13.0及之前版本.
solution:Upgrade tibco activematrix_businessworks to a higher version than 5.13.0,and avoid the version (,5.13.0]; Upgrade tibco activematrix_businessworks_distribution_for_tibco_silver_fabric to a higher version than 5.13.0,and avoid the version (,5.13.0]