CVE-2021-23274 - OpenCVE

The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Tibco	Api Exchange Gateway Distribution Api Exchange Gateway

Configuration 1 [-]

OR	cpe:2.3:a:tibco:api_exchange_gateway::::::::
	cpe:2.3:a:tibco:api_exchange_gateway_distribution::::::silver_fabric::*

References

Link	Resource
http://www.tibco.com/services/support/advisories	Vendor Advisory
https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: tibco

Published: 2021-03-23T00:00:00

Updated: 2021-03-23T17:06:08

Reserved: 2021-01-08T00:00:00

Link: CVE-2021-23274

JSON object: View

NVD Information

Status : Modified

Published: 2021-03-23T17:15:13.903

Modified: 2023-11-07T03:30:51.140

Link: CVE-2021-23274

JSON object: View

Redhat Information

No data.

CWE

CWE-1021

{"containers": {"cna": {"affected": [{"product": "TIBCO API Exchange Gateway", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "2.3.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "2.3.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2021-03-23T00:00:00", "descriptions": [{"lang": "en", "value": "The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "The impact of this vulnerability includes the theoretical possibility that an attacker gains full administrative access to the affected system.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-23T17:06:08", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO API Exchange Gateway versions 2.3.3 and below update to version 2.4.0 or higher\nTIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.3 and below update to version 2.4.0 or higher"}], "source": {"discovery": "INTERNAL"}, "title": "TIBCO API Exchange Gateway Clickjack Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2021-03-23T17:00:00Z", "ID": "CVE-2021-23274", "STATE": "PUBLIC", "TITLE": "TIBCO API Exchange Gateway Clickjack Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO API Exchange Gateway", "version": {"version_data": [{"version_affected": "<=", "version_value": "2.3.3"}]}}, {"product_name": "TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric", "version": {"version_data": [{"version_affected": "<=", "version_value": "2.3.3"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "The impact of this vulnerability includes the theoretical possibility that an attacker gains full administrative access to the affected system."}]}]}, "references": {"reference_data": [{"name": "http://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "http://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO API Exchange Gateway versions 2.3.3 and below update to version 2.4.0 or higher\nTIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.3 and below update to version 2.4.0 or higher"}], "source": {"discovery": "INTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2021-23274", "datePublished": "2021-03-23T00:00:00", "dateReserved": "2021-01-08T00:00:00", "dateUpdated": "2021-03-23T17:06:08", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC95D668-5D8F-4E67-BD65-34A6DB32418E", "versionEndIncluding": "2.3.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:api_exchange_gateway_distribution:*:*:*:*:*:silver_fabric:*:*", "matchCriteriaId": "47B681F1-CDB8-4CB3-98A8-FCF134B32C6B", "versionEndIncluding": "2.3.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below."}, {"lang": "es", "value": "El componente Config UI de TIBCO API Exchange Gateway de TIBCO Software Inc. y TIBCO API Exchange Gateway Distribution para TIBCO Silver Fabric, contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante no autenticado con acceso a la red ejecutar un ataque de clickjacking en el sistema afectado. Un ataque con \u00e9xito que use esta vulnerabilidad no requiere la interacci\u00f3n humana de una persona diferente del atacante. Las versiones afectadas son TIBCO API Exchange Gateway de TIBCO Software Inc.: versiones 2.3.3 y anteriores y TIBCO API Exchange Gateway Distribution para TIBCO Silver Fabric: versiones 2.3.3 y anteriores"}], "id": "CVE-2021-23274", "lastModified": "2023-11-07T03:30:51.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@tibco.com", "type": "Secondary"}]}, "published": "2021-03-23T17:15:13.903", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "http://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-23-2021-tibco-api-exchange-gateway"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "nvd@nist.gov", "type": "Primary"}]}