Skip to content
CVE Tracker
Back

CVE-2019-17331

TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities

High7.3EPSS 0.61%
Published
Updated
Reserved
Assigned by
tibco

Description

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.

Scores

CVSS scores of CVE-2019-17331, by who scored it
Scored byCVSSScoreVector
tibcoCNA (assigner)3.0High7.3CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVDNVD · Modified3.1Medium5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.61% · top 51% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

  • The impact of this vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.
  • CWE-79 (opens in a new tab)

Affected products

  • TIBCO Software Inc. · TIBCO EBX Add-ons

    • affected unspecified – ≤ 3.20.13
    • affected 4.1.0

What to do

Solution: TIBCO has released updated versions of the affected components which address these issues. TIBCO EBX Add-ons versions 3.20.13 and below update to version 3.20.14 or higher TIBCO EBX Add-ons version 4.1.0 update to version 4.2.0 or higher

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .