title: TIBCO eFTL Token Generation Vulnerability
description: The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
problem types: Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
affected:
{
product: TIBCO eFTL - Community Edition
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.7.2, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO eFTL - Developer Edition
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.7.2, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO eFTL - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.7.2, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO eFTL - Community Edition versions 6.7.2 and below update to version 6.7.3 or later
TIBCO eFTL - Developer Edition versions 6.7.2 and below update to version 6.7.3 or later
TIBCO eFTL - Enterprise Edition versions 6.7.2 and below update to version 6.7.3 or later