title: TIBCO EBX Exposes Multiple Cross-Site Scripting Vulnerabilities
description: The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow authenticated users to perform stored cross-site scripting (XSS) attacks, and unauthenticated users to perform reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions up to and including 5.8.1.fixR, versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6.
problem types: The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
affected:
{
product: TIBCO EBX
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.8.1.fixR, status: affected, version: unspecified, versionType: custom
status: affected, version: 5.9.3
status: affected, version: 5.9.4
status: affected, version: 5.9.5
status: affected, version: 5.9.6
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO EBX versions 5.8.1.fixR and below update to version 5.8.1.fixS or higher
TIBCO EBX versions 5.9.3, 5.9.4, 5.9.5, and 5.9.6 update to version 5.9.7 or higher