title: TIBCO EBX Add-ons SQL Injection Vulnerability
description: The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 4.5.17, status: affected, version: 0, versionType: semver
lessThanOrEqual: 5.6.2, status: affected, version: 0, versionType: semver
status: affected, version: 6.1.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO EBX Add-ons versions 4.5.17 and below: update to version 4.5.18 or later
TIBCO EBX Add-ons versions 5.6.2 and below: update to version 5.6.3 or later
TIBCO EBX Add-ons version 6.1.0: update to version 6.1.1 or later