title: TIBCO MDM Exposes Cross-Site Scripting Vulnerabilities
description: The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue affects TIBCO Software Inc.'s TIBCO MDM version 9.0.1 and prior versions; version 9.1.0.
problem types: The impact of these vulnerabilities includes the theoretical possibility that a non-administrative user could gain full administrative access to the web interface of the affected component.
affected:
{
product: TIBCO MDM
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 9.0.1, status: affected, version: unspecified, versionType: custom
status: affected, version: 9.1.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
]
solutions: TIBCO has released updated versions of the affected systems which address these issues:
TIBCO MDM versions 9.0.1 and below update to version 9.0.2 or higher.
TIBCO MDM version 9.1.0 update to version 9.1.2 or higher.