CVE-2018-12413
TIBCO Messaging - Apache Kafka Distribution - Schema Repository Vulnerable to CSRF Attacks
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The Schema repository server (tibschemad) component of TIBCO Software Inc.'s TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition contains a vulnerability which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc. TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition: 1.0.0, and TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition: 1.0.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | High8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.87% · top 41% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- The impact of this vulnerability includes the theoretical possibility that an attacker could gain full access to the configuration of message schemas used with an Apache Kafka deployment. With such access, the attacker could also configure Apache Kafka communications to fail.
- CWE-352 (opens in a new tab)All about CWE-352 and its CVEs
Affected products
What to do
Solution: TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Community Edition version 1.0.0 update to version 1.0.1 or higher TIBCO Messaging - Apache Kafka Distribution - Schema Repository - Enterprise Edition version 1.0.0 update to version 1.0.1 or higher.
References (3)
- http://www.tibco.com/services/support/advisories (opens in a new tab)x_refsource_MISCx_transferred
- 105874 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-messaging-apache-kafka-distribution-schema-repository (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-12413)Record last updated .