Vulnerability-Lookup

CNVD-2021-39542

Vulnerability from cnvd - Published: 2021-06-04

Title

TIBCO Software Managed File Transfer Command Center和Internet Server跨站脚本漏洞（CNVD-2021-39542）

Description

TIBCO Software Managed File Transfer Command Center和TIBCO Software Managed File Transfer Internet Server都是美国TIBCO Software公司的产品。TIBCO Software Managed File Transfer Command Center是一套企业文件传输管理解决方案。TIBCO Software Managed File Transfer Internet Server是一款企业文件传输服务器。 TIBCO Software Managed File Transfer Command Center 8.2.1及之前版本和TIBCO Software Managed File Transfer Internet Server 8.2.1及之前版本中的MFT Browser file transfer client和MFT Browser admin client组件存在跨站脚本漏洞，攻击者可通过构造URL利用该漏洞执行任意命令。

Severity

高

Patch Name

TIBCO Software Managed File Transfer Command Center和Internet Server跨站脚本漏洞（CNVD-2021-39542）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-30-2020-tibco-managed-file-transfer-2020-9413

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-9413

Impacted products

Name
['TIBCO Managed File Transfer Command Center <=8.2.1', 'TIBCO Managed File Transfer Internet Server <=8.2.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9413"
    }
  },
  "description": "TIBCO Software Managed File Transfer Command Center\u548cTIBCO Software Managed File Transfer Internet Server\u90fd\u662f\u7f8e\u56fdTIBCO Software\u516c\u53f8\u7684\u4ea7\u54c1\u3002TIBCO Software Managed File Transfer Command Center\u662f\u4e00\u5957\u4f01\u4e1a\u6587\u4ef6\u4f20\u8f93\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002TIBCO Software Managed File Transfer Internet Server\u662f\u4e00\u6b3e\u4f01\u4e1a\u6587\u4ef6\u4f20\u8f93\u670d\u52a1\u5668\u3002\n\nTIBCO Software Managed File Transfer Command Center 8.2.1\u53ca\u4e4b\u524d\u7248\u672c\u548cTIBCO Software Managed File Transfer Internet Server 8.2.1\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684MFT Browser file transfer client\u548cMFT Browser admin client\u7ec4\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020URL\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-30-2020-tibco-managed-file-transfer-2020-9413",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-39542",
  "openTime": "2021-06-04",
  "patchDescription": "TIBCO Software Managed File Transfer Command Center\u548cTIBCO Software Managed File Transfer Internet Server\u90fd\u662f\u7f8e\u56fdTIBCO Software\u516c\u53f8\u7684\u4ea7\u54c1\u3002TIBCO Software Managed File Transfer Command Center\u662f\u4e00\u5957\u4f01\u4e1a\u6587\u4ef6\u4f20\u8f93\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002TIBCO Software Managed File Transfer Internet Server\u662f\u4e00\u6b3e\u4f01\u4e1a\u6587\u4ef6\u4f20\u8f93\u670d\u52a1\u5668\u3002\r\n\r\nTIBCO Software Managed File Transfer Command Center 8.2.1\u53ca\u4e4b\u524d\u7248\u672c\u548cTIBCO Software Managed File Transfer Internet Server 8.2.1\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u7684MFT Browser file transfer client\u548cMFT Browser admin client\u7ec4\u4ef6\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u6784\u9020URL\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "TIBCO Software Managed File Transfer Command Center\u548cInternet Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2021-39542\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "TIBCO Managed File Transfer Command Center \u003c=8.2.1",
      "TIBCO Managed File Transfer Internet Server \u003c=8.2.1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9413",
  "serverity": "\u9ad8",
  "submitTime": "2020-07-01",
  "title": "TIBCO Software Managed File Transfer Command Center\u548cInternet Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff08CNVD-2021-39542\uff09"
}

CVE-2020-9413 (GCVE-0-2020-9413)

Vulnerability from cvelistv5 – Published: 2020-06-30 19:40 – Updated: 2024-09-17 01:07

Title

TIBCO Managed File Transfer reflected XSS vulerability

Summary

The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.

Severity ?

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CWE

The impact of this vulnerability includes the possibility that an attacker can gain access to the session ID of the affected user's session and take any action the affected user has privilege to perform.

Assigner

tibco

References

URL

Tags

http://www.tibco.com/services/support/advisories

x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

TIBCO Software Inc.

TIBCO Managed File Transfer Command Center

Affected: unspecified , ≤ 8.2.1 (custom)

TIBCO Software Inc.

TIBCO Managed File Transfer Internet Server

Affected: unspecified , ≤ 8.2.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:26:16.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.tibco.com/services/support/advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO Managed File Transfer Command Center",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Managed File Transfer Internet Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "8.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-06-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.\u0027s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "The impact of this vulnerability includes the possibility that an attacker can gain access to  the session ID of the affected user\u0027s session and take any action the affected user has privilege to perform.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-30T19:40:14",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.tibco.com/services/support/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Managed File Transfer Command Center versions 8.2.1 and below update to version 8.3.0 or higher\nTIBCO Managed File Transfer Internet Server versions 8.2.1 and below update to version 8.3.0 or higher"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO Managed File Transfer reflected XSS vulerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2020-06-30T17:00:00Z",
          "ID": "CVE-2020-9413",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO Managed File Transfer reflected XSS vulerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO Managed File Transfer Command Center",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "8.2.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Managed File Transfer Internet Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "8.2.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.\u0027s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "The impact of this vulnerability includes the possibility that an attacker can gain access to  the session ID of the affected user\u0027s session and take any action the affected user has privilege to perform."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.tibco.com/services/support/advisories",
              "refsource": "CONFIRM",
              "url": "http://www.tibco.com/services/support/advisories"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Managed File Transfer Command Center versions 8.2.1 and below update to version 8.3.0 or higher\nTIBCO Managed File Transfer Internet Server versions 8.2.1 and below update to version 8.3.0 or higher"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2020-9413",
    "datePublished": "2020-06-30T19:40:14.183392Z",
    "dateReserved": "2020-02-26T00:00:00",
    "dateUpdated": "2024-09-17T01:07:05.625Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-39542

CVE-2020-9413 (GCVE-0-2020-9413)

Tags

Sightings

Nomenclature