title: TIBCO FTL unvalidated SAN in client certificates
description: The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.
problem types: The impact of this vulnerability includes the theoretical possibility that a malicious non-administrative user can gain full administrative access to the affected system.
affected:
{
product: TIBCO ActiveSpaces - Community Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 4.3.0
status: affected, version: 4.4.0
status: affected, version: 4.5.0
status: affected, version: 4.6.0
status: affected, version: 4.6.1
status: affected, version: 4.6.2
}
{
product: TIBCO ActiveSpaces - Developer Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 4.3.0
status: affected, version: 4.4.0
status: affected, version: 4.5.0
status: affected, version: 4.6.0
status: affected, version: 4.6.1
status: affected, version: 4.6.2
}
{
product: TIBCO ActiveSpaces - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 4.3.0
status: affected, version: 4.4.0
status: affected, version: 4.5.0
status: affected, version: 4.6.0
status: affected, version: 4.6.1
status: affected, version: 4.6.2
}
{
product: TIBCO FTL - Community Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
{
product: TIBCO FTL - Developer Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
{
product: TIBCO FTL - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
{
product: TIBCO eFTL - Community Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
{
product: TIBCO eFTL - Developer Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
{
product: TIBCO eFTL - Enterprise Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.0
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.4.0
status: affected, version: 6.5.0
status: affected, version: 6.6.0
status: affected, version: 6.6.1
status: affected, version: 6.7.0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO ActiveSpaces - Community Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later
TIBCO ActiveSpaces - Developer Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later
TIBCO ActiveSpaces - Enterprise Edition versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2 update to version 4.7.0 or later
TIBCO FTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later
TIBCO FTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later
TIBCO FTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later
TIBCO eFTL - Community Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later
TIBCO eFTL - Developer Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later
TIBCO eFTL - Enterprise Edition versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0 update to version 6.7.1 or later