title: TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability
description: The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Platform Server for z/Linux contain a difficult to exploit Remote Code Execution (RCE) vulnerability that allows a low privileged attacker with network access to execute arbitrary code on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX: versions 8.1.0 and below and TIBCO Managed File Transfer Platform Server for z/Linux: versions 8.1.0 and below.
problem types: Successful execution of this vulnerability can result in a low privileged attacker gaining full user access to the affected system.
affected:
{
product: TIBCO Managed File Transfer Platform Server for UNIX
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 8.1.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Managed File Transfer Platform Server for z/Linux
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 8.1.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Managed File Transfer Platform Server for UNIX versions 8.1.0 and below update to version 8.1.1 or later
TIBCO Managed File Transfer Platform Server for z/Linux versions 8.1.0 and below update to version 8.1.1 or later