CVE-2018-12408
TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.3% · top 16% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- The impact of this vulnerability includes the theoretical possibility of an unauthenticated user gaining access to sensitive information that is available to the system account hosting the BusinessWorks engine.
- CWE-611 (opens in a new tab)All about CWE-611 and its CVEs
Affected products
TIBCO Software Inc. · TIBCO ActiveMatrix BusinessWorks
- affected unspecified – ≤ 5.13.0
TIBCO Software Inc. · TIBCO ActiveMatrix BusinessWorks for z/Linux
- affected unspecified – ≤ 5.13.0
TIBCO Software Inc. · TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric
- affected unspecified – ≤ 5.13.0
What to do
Solution: TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO ActiveMatrix BusinessWorks versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks for z/Linux versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions 5.13.0 and below update to version 5.13.1 or higher.
References (3)
- https://www.tibco.com/support/advisories/2018/08/tibco-security-advisory-august-7-2018-tibco-activematrix-businessworks (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://www.tibco.com/services/support/advisories (opens in a new tab)x_refsource_MISCx_transferred
- 105043 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-12408)Record last updated .