title: TIBCO Administrator - Enterprise Edition Cross-Site Scripting Vulnerability
description: The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting (XSS) attacks by way of manipulating artifacts prior to uploading them. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions up to and including 5.10.0, and TIBCO Administrator - Enterprise Edition for z/Linux: versions up to and including 5.9.1.
problem types: The impact of the vulnerability includes the theoretical possibility of a user performing operations using another user's access, including administrative functions being performed by a non-administrative user. The impact also theoretically includes access to all administrative information, including deployment variable settings ("global variables")
affected:
{
product: TIBCO Administrator - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.10.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Administrator - Enterprise Edition for z/Linux
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.9.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
For each affected system, update to the corresponding software versions:
TIBCO Administrator - Enterprise Edition versions 5.10.0 and below update to version 5.10.1 or higher
TIBCO Administrator - Enterprise Edition for z/Linux versions 5.9.1 and below update to version 5.10.1 or higher