CVE-2021-35500 - OpenCVE

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:L/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Tibco	Data Virtualization For Aws Marketplace Data Virtualization

Configuration 1 [-]

OR	cpe:2.3:a:tibco:data_virtualization::::::::
	cpe:2.3:a:tibco:data_virtualization:8.4.0:::::::*
	cpe:2.3:a:tibco:data_virtualization:8.5.0:::::::*
	cpe:2.3:a:tibco:data_virtualization_for_aws_marketplace::::::::

References

Link	Resource
https://www.tibco.com/services/support/advisories	Vendor Advisory
https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: tibco

Published: 2022-01-12T00:00:00

Updated: 2022-01-12T19:06:22

Reserved: 2021-06-24T00:00:00

Link: CVE-2021-35500

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-01-12T19:15:08.130

Modified: 2022-01-19T19:38:21.370

Link: CVE-2021-35500

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "8.3.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "8.4.0"}]}, {"product": "TIBCO Data Virtualization", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "8.5.0"}]}, {"product": "TIBCO Data Virtualization for AWS Marketplace", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "8.5.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2022-01-12T00:00:00", "descriptions": [{"lang": "en", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-01-12T19:06:22", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Data Virtualization versions 8.3.0 and below update to version 8.3.1 or later\nTIBCO Data Virtualization version 8.4.0 update to version 8.4.1 or later\nTIBCO Data Virtualization version 8.5.0 update to version 8.5.1 or later\nTIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below update to version 8.5.1 or later"}], "source": {"discovery": "USER"}, "title": "TIBCO Data Virtualization Arbitrary File Download vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2022-01-12T17:00:00Z", "ID": "CVE-2021-35500", "STATE": "PUBLIC", "TITLE": "TIBCO Data Virtualization Arbitrary File Download vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.3.0"}]}}, {"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "=", "version_value": "8.4.0"}]}}, {"product_name": "TIBCO Data Virtualization", "version": {"version_data": [{"version_affected": "=", "version_value": "8.5.0"}]}}, {"product_name": "TIBCO Data Virtualization for AWS Marketplace", "version": {"version_data": [{"version_affected": "<=", "version_value": "8.5.0"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Successful execution of this vulnerability can result in unauthorized read access to all files on the affected system."}]}]}, "references": {"reference_data": [{"name": "https://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "https://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Data Virtualization versions 8.3.0 and below update to version 8.3.1 or later\nTIBCO Data Virtualization version 8.4.0 update to version 8.4.1 or later\nTIBCO Data Virtualization version 8.5.0 update to version 8.5.1 or later\nTIBCO Data Virtualization for AWS Marketplace versions 8.5.0 and below update to version 8.5.1 or later"}], "source": {"discovery": "USER"}}}}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2021-35500", "datePublished": "2022-01-12T00:00:00", "dateReserved": "2021-06-24T00:00:00", "dateUpdated": "2022-01-12T19:06:22", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:data_virtualization:*:*:*:*:*:*:*:*", "matchCriteriaId": "58C2A35E-A0EA-41B6-B48F-F4F014549D93", "versionEndIncluding": "8.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization:8.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "CD2D931C-9084-4B44-A872-DC4B950042A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization:8.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "5B922E97-D9D6-4697-8253-76D26E5E8DBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:data_virtualization_for_aws_marketplace:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B4B7AA2-5578-4DDE-A7D1-0311A77A30C9", "versionEndIncluding": "8.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below."}, {"lang": "es", "value": "El componente Data Virtualization Server de TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, y TIBCO Data Virtualization for AWS Marketplace contiene una vulnerabilidad dif\u00edcil de explotar que permite a un atacante con pocos privilegios y acceso local descargar archivos arbitrarios fuera del alcance de los permisos del usuario en el sistema afectado. Las versiones afectadas son TIBCO Data Virtualization de TIBCO Software Inc.: versiones 8.3.0 y anteriores, TIBCO Data Virtualization: versi\u00f3n 8.4.0, TIBCO Data Virtualization: versi\u00f3n 8.5.0, y TIBCO Data Virtualization para AWS Marketplace: versiones 8.5.0 y anteriores"}], "id": "CVE-2021-35500", "lastModified": "2022-01-19T19:38:21.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "security@tibco.com", "type": "Secondary"}]}, "published": "2022-01-12T19:15:08.130", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}