title: TIBCO ActiveSpaces Information Leak Vulnerability
description: The Proxy and Client components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition contain a vulnerability that theoretically allows an Active Spaces client to passively observe data traffic to other clients. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Enterprise Edition: versions 4.4.0 through 4.9.0.
problem types: This impact of this vulnerability includes the theoretical possibility of bypassing table access controls.  The attacker cannot actively make queries, but may observe the results of queries by other clients, even though the attacker does not have permission to access that data.
affected:
{
defaultStatus: unknown
product: TIBCO ActiveSpaces - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 4.9.0, status: affected, version: 4.4.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO ActiveSpaces - Enterprise Edition versions 4.4.0 through 4.9.0: update to version 4.9.1 or later