CVE-2021-28823

The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below.

CVSS v3 8.8 HIGH
CVSS v2.0 4.6 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.tibco.com/services/support/advisories	Vendor Advisory
http://www.tibco.com/services/support/advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tibco:eftl:::::community:::*
	cpe:2.3:a:tibco:eftl:::::developer:::*
	cpe:2.3:a:tibco:eftl:::::enterprise:::*

History

21 Nov 2024, 06:00

Type	Values Removed	Values Added
CVSS	v2 : ~~4.6~~ v3 : ~~7.8~~	v2 : 4.6 v3 : 8.8
References	~~() http://www.tibco.com/services/support/advisories - Vendor Advisory~~	() http://www.tibco.com/services/support/advisories - Vendor Advisory

Information

Published : 2021-03-23 21:15

Updated : 2024-11-21 06:00

NVD link : CVE-2021-28823

Mitre link : CVE-2021-28823

CVE.ORG link : CVE-2021-28823

JSON object : View

Products Affected

tibco

eftl

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2021-28823", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security@tibco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-03-23T21:15:14.180", "references": [{"url": "http://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}, {"url": "http://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Windows Installation component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.5.0 and below, TIBCO eFTL - Developer Edition: versions 6.5.0 and below, and TIBCO eFTL - Enterprise Edition: versions 6.5.0 and below."}, {"lang": "es", "value": "El componente de instalaci\u00f3n de Windows de TIBCO eFTL - Community Edition de TIBCO Software Inc., TIBCO eFTL - Developer Edition y TIBCO eFTL - Enterprise Edition, contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante poco privilegiado con acceso local en algunas versiones del sistema operativo Windows insertar software malicioso. Se puede abusar del componente afectado para ejecutar el software malicioso insertado por el atacante con los privilegios elevados del componente. Esta vulnerabilidad es debido a una falta de restricciones de acceso a determinados archivos y/o carpetas en la instalaci\u00f3n. Las versiones afectadas son TIBCO eFTL - Community Edition de TIBCO Software Inc.: versiones 6.5.0 y por debajo, TIBCO eFTL - Developer Edition: versiones 6.5.0 y por debajo, y TIBCO eFTL - Enterprise Edition: versiones 6.5.0 y por debajo"}], "lastModified": "2024-11-21T06:00:16.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "FCA4319C-1790-426D-96D8-8BA8DF72DBC2", "versionEndExcluding": "6.6.0"}, {"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*", "vulnerable": true, "matchCriteriaId": "6E4A78A7-5FAE-4B70-8EC5-3D409B833D72", "versionEndExcluding": "6.6.0"}, {"criteria": "cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CB170CBF-8BA5-45D1-B540-BD124AD8E32C", "versionEndExcluding": "6.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@tibco.com"}