title: TIBCO DataSynapse GridServer manager component vulnerable to cross-site scripting attacks
description: The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilities which may allow an authenticated user to perform cross-site scripting (XSS). In addition, an authenticated user could be a victim of a cross-site request forgery (CSRF) attack. Affected releases include TIBCO Software Inc.'s TIBCO DataSynapse GridServer Manager: versions up to and including 5.1.3; 6.0.0; 6.0.1; 6.0.2; 6.1.0; 6.1.1; and 6.2.0.
problem types: The impact of this vulnerability includes the possibility that a malicious actor could gain access to a more privileged account on the affected components or the information managed by those components.
affected:
{
product: TIBCO DataSynapse GridServer Manager
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 5.1.3, status: affected, version: unspecified, versionType: custom
status: affected, version: 6.0.0
status: affected, version: 6.0.1
status: affected, version: 6.0.2
status: affected, version: 6.1.0
status: affected, version: 6.1.1
status: affected, version: 6.2.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:
TIBCO DataSynapse GridServer Manager versions 5.1.3 and below update to version 5.2.0 or higher
TIBCO DataSynapse GridServer Manager versions 6.0.0, 6.0.1, and 6.0.2 update to version 6.3.0 or higher
TIBCO DataSynapse GridServer Manager versions 6.1.0, and 6.1.1 update to version 6.3.0 or higher
TIBCO DataSynapse GridServer Manager version 6.2.0 update to version 6.3.0 or higher