title: TIBCO Operational Intelligence Hawk RedTail Credential Exposure Vulnerability
description: The Hawk Console and Hawk Agent components of TIBCO Software Inc.'s TIBCO Hawk, TIBCO Hawk Distribution for TIBCO Silver Fabric, TIBCO Operational Intelligence Hawk RedTail, and TIBCO Runtime Agent contain a vulnerability that theoretically allows an attacker with access to the Hawk Console’s and Agent’s log to obtain credentials used to access associated EMS servers. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.2.2 and below, TIBCO Hawk Distribution for TIBCO Silver Fabric: versions 6.2.2 and below, TIBCO Operational Intelligence Hawk RedTail: versions 7.2.1 and below, and TIBCO Runtime Agent: versions 5.12.2 and below.
problem types: The impact of this vulnerability includes the theoretical possibility that an attacker could access the message stream of the EMS server, or in the worst case, gain administrative access to the server.
affected:
{
defaultStatus: unaffected
product: TIBCO Hawk
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.2.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: TIBCO Hawk Distribution for TIBCO Silver Fabric
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.2.2, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: TIBCO Operational Intelligence Hawk RedTail
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 7.2.1, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: TIBCO Runtime Agent
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.12.2, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Hawk versions 6.2.2 and below: update to version 6.2.3 or later
TIBCO Hawk Distribution for TIBCO Silver Fabric versions 6.2.2 and below: update to version 6.2.3 or later
TIBCO Operational Intelligence Hawk RedTail versions 7.2.1 and below: update to version 7.2.2 or later
TIBCO Runtime Agent versions 5.12.2 and below: update to version 5.12.3 or later