CVE-2019-11212
TIBCO MDM Exposes Cross-Site Scripting Vulnerabilities
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an authenticated user with specific roles to perform cross-site scripting (XSS) attacks. This issue affects TIBCO Software Inc.'s TIBCO MDM version 9.0.1 and prior versions; version 9.1.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.1 | Medium6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.68% · top 47% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.
Weakness
- The impact of these vulnerabilities includes the theoretical possibility that a non-administrative user could gain full administrative access to the web interface of the affected component.
- CWE-79 (opens in a new tab)All about CWE-79 and its CVEs
Affected products
TIBCO Software Inc. · TIBCO MDM
- affected unspecified – ≤ 9.0.1
- affected 9.1.0
What to do
Solution: TIBCO has released updated versions of the affected systems which address these issues: TIBCO MDM versions 9.0.1 and below update to version 9.0.2 or higher. TIBCO MDM version 9.1.0 update to version 9.1.2 or higher.
References (2)
- http://www.tibco.com/services/support/advisories (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.tibco.com/support/advisories/2019/10/tibco-security-advisory-october-8-2019-tibco-mdm (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-11212)Record last updated .