title: TIBCO EBX Exposes Cross-Site Scripting Vulnerability
description: The Web server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.1.fixS and below, versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7.
problem types: The impact of these vulnerabilities includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
affected:
{
product: TIBCO EBX
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.8.1.fixS, status: affected, version: unspecified, versionType: custom
status: affected, version: 5.9.3
status: affected, version: 5.9.4
status: affected, version: 5.9.5
status: affected, version: 5.9.6
status: affected, version: 5.9.7
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO EBX versions 5.8.1.fixS and below update to version 5.8.1.fixT or higher
TIBCO EBX versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, and 5.9.7 update to version 5.9.8 or higher