title: TIBCO Data Virtualization
description: The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user must be authenticated and have privileges required to monitor the server in an operational capacity. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 7.0.8 and below, versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 and TIBCO Data Virtualization for AWS Marketplace: versions 8.2.0 and below.
problem types: The impact of these vulnerabilities includes the theoretical possibility that a malicious user could exfiltrate any data file on the affected system. The malicious user cannot modify or delete any files on the affected system with this vulnerability.
affected:
{
product:  TIBCO Data Virtualization
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 7.0.8, status: affected, version: unspecified, versionType: custom
status: affected, version: 8.0.0
status: affected, version: 8.1.0
status: affected, version: 8.1.1
status: affected, version: 8.2.0
}
{
product:  TIBCO Data Virtualization for AWS Marketplace
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 8.2.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Data Virtualization versions 7.0.8 and below update to version 7.0.9 or higher
TIBCO Data Virtualization versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 update to version 8.3.0 or higher
TIBCO Data Virtualization for AWS Marketplace versions 8.2.0 and below update to version 8.3.0 or higher