// For flags

CVE-2020-9411

TIBCO Managed File Transfer Platform Server for IBM i Authentication Bypass

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.

El componente file transfer de TIBCO Managed File Transfer Platform Server para IBM i de TIBCO Software Inc, contiene una vulnerabilidad que teóricamente permite a un atacante llevar a cabo transferencias de archivos de red no autorizadas hacia y desde el sistema de archivos accesible al componente afectado. Esta vulnerabilidad es explotable cuando la opción de configuración "Require Node Resp" está establecida en "No". En el caso de una explotación con éxito, el atacante podría leer y escribir teóricamente cualquier archivo en el sistema de archivos accesible para el componente afectado, afectando así completamente la confidencialidad, integridad y disponibilidad del sistema operativo que aloja la implementación del sistema afectado. Las versiones afectadas son TIBCO Managed File Transfer Platform Server para IBM i de TIBCO Software Inc: versiones 7.1.0 y posteriores, versión 8.0.0

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-02-26 CVE Reserved
  • 2020-06-09 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tibco
Search vendor "Tibco"
 Managed File Transfer Platform Server
Search vendor "Tibco" for product "Managed File Transfer Platform Server"
 <= 7.1.0
Search vendor "Tibco" for product "Managed File Transfer Platform Server" and version " <= 7.1.0"
-
Affected
in Ibm
Search vendor "Ibm"
 I
Search vendor "Ibm" for product "I"
--
Safe
Tibco
Search vendor "Tibco"
 Managed File Transfer Platform Server
Search vendor "Tibco" for product "Managed File Transfer Platform Server"
 8.0.0
Search vendor "Tibco" for product "Managed File Transfer Platform Server" and version "8.0.0"
-
Affected
in Ibm
Search vendor "Ibm"
 I
Search vendor "Ibm" for product "I"
--
Safe