CVE-2022-22774

The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute XML External Entity (XXE) attacks on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.3.1 and below, TIBCO Managed File Transfer Command Center: versions 8.4.0 and 8.4.1, TIBCO Managed File Transfer Internet Server: versions 8.3.1 and below, and TIBCO Managed File Transfer Internet Server: versions 8.4.0 and 8.4.1.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.tibco.com/services/support/advisories	Vendor Advisory
https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-10-2022-tibco-mftcc-2022-22774	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tibco:managed_file_transfer_command_center::::::::
	cpe:2.3:a:tibco:managed_file_transfer_command_center::::::::
	cpe:2.3:a:tibco:managed_file_transfer_internet_server::::::::
	cpe:2.3:a:tibco:managed_file_transfer_internet_server::::::::

History

No history.

Information

Published : 2022-05-10 17:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-22774

Mitre link : CVE-2022-22774

CVE.ORG link : CVE-2022-22774

JSON object : View

Products Affected

tibco

managed_file_transfer_internet_server
managed_file_transfer_command_center

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2022-22774", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security@tibco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2022-05-10T17:15:08.057", "references": [{"url": "https://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}, {"url": "https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-10-2022-tibco-mftcc-2022-22774", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute XML External Entity (XXE) attacks on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.3.1 and below, TIBCO Managed File Transfer Command Center: versions 8.4.0 and 8.4.1, TIBCO Managed File Transfer Internet Server: versions 8.3.1 and below, and TIBCO Managed File Transfer Internet Server: versions 8.4.0 and 8.4.1."}, {"lang": "es", "value": "Los componentes DOM XML parser y SAX XML parser de TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, y TIBCO Managed File Transfer Internet Server contienen una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante no autenticado con acceso a la red ejecutar ataques de tipo XML External Entity (XXE) en el sistema afectado. Las versiones afectadas son TIBCO Managed File Transfer Command Center de TIBCO Software Inc.: versiones 8.3.1 y anteriores, TIBCO Managed File Transfer Command Center: versiones 8.4.0 y 8.4.1, TIBCO Managed File Transfer Internet Server: versiones 8.3.1 y anteriores, y TIBCO Managed File Transfer Internet Server: versiones 8.4.0 y 8.4.1"}], "lastModified": "2022-05-19T17:24:35.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:managed_file_transfer_command_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1E26879-B28C-4BA8-865E-12207F1A0623", "versionEndExcluding": "8.3.2"}, {"criteria": "cpe:2.3:a:tibco:managed_file_transfer_command_center:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86EAB55B-686A-4909-87FB-7C71B855EEBB", "versionEndExcluding": "8.4.2", "versionStartIncluding": "8.4.0"}, {"criteria": "cpe:2.3:a:tibco:managed_file_transfer_internet_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF740925-2AB3-4A12-8DCB-E31D330BAA58", "versionEndExcluding": "8.3.2"}, {"criteria": "cpe:2.3:a:tibco:managed_file_transfer_internet_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C1EB94F-463A-4DCA-A39D-9E5706F96C60", "versionEndExcluding": "8.4.2", "versionStartIncluding": "8.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@tibco.com"}