title: TIBCO EBX Add-ons Arbitrary File Write
description: The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below.
problem types: An application administrator without access to the underlying server could upload files that may be evaluated by the web server allowing them to perform actions with the privileges of the web server.
affected:
{
defaultStatus: unknown
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 4.5.16, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO EBX Add-ons versions 4.5.16 and below: update to version 4.5.17 or later