title: SAML protocol handling errors in tibbr
description: The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0, tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0.
problem types: The impact of this vulnerability includes, for already authorized users, the theoretical escalation of privileges to those of any other user.
affected:
{
product: tibbr Community
vendor: TIBCO Software Inc.
versions:
status: affected, version: 5.2.1 and below
status: affected, version: 6.0.0
status: affected, version: 6.0.1
status: affected, version: 7.0.0
}
{
product: tibbr Enterprise
vendor: TIBCO Software Inc.
versions:
status: affected, version: 5.2.1 and below
status: affected, version: 6.0.0
status: affected, version: 6.0.1
status: affected, version: 7.0.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.0
]