title: TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks
description: The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.
problem types: The impact of this vulnerability includes the theoretical possibility that an attacker could gain full access to the configuration of message schemas used with an Apache Kafka deployment. With such access, the attacker could also configure Apache Kafka communications to fail.
affected:
{
product: TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 1.0.0
}
{
product: TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 1.0.0
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:
TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition version 1.0.0 update to version 1.0.1 or higher
TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition version 1.0.0 update to version 1.0.1 or higher.