title: TIBCO Data Virtualization Arbitrary File Download vulnerability
description: The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.
problem types: Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system.
affected:
{
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 8.3.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
versions:
status: affected, version: 8.4.0
}
{
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
versions:
status: affected, version: 8.5.0
}
{
product: TIBCO Data Virtualization for AWS Marketplace
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 8.5.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Data Virtualization versions 8.3.0 and below update to version 8.3.1 or later
TIBCO Data Virtualization version 8.4.0 update to version 8.4.1 or later
TIBCO Data Virtualization version 8.5.0 update to version 8.5.1 or later
TIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below update to version 8.5.1 or later