title: TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities
description: The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.
problem types: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
affected:
{
product: TIBCO EBX Add-ons
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 3.20.13, status: affected, version: unspecified, versionType: custom
status: affected, version: 4.1.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO EBX Add-ons versions 3.20.13 and below update to version 3.20.14 or higher
TIBCO EBX Add-ons version 4.1.0 update to version 4.2.0 or higher