CVE-2021-28828

TIBCO Administrator SQL injection vulnerability

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition for z/Linux, and TIBCO Administrator - Enterprise Edition for z/Linux contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a SQL injection attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1, TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below, and TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1.

El componente GUI de Administración de TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition, TIBCO Administrator - Enterprise Edition Distribution para TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition Distribution para TIBCO Silver Fabric, TIBCO Administrator - Enterprise Edition para z/Linux y TIBCO Administrator - Enterprise Edition para z/Linux de TIBCO Software Inc, contiene una vulnerabilidad fácilmente explotable que permite a un atacante poco privilegiado con acceso a la red ejecutar un ataque de inyección SQL en el sistema afectado. Las versiones afectadas son TIBCO Administrator - Enterprise Edition: versiones 5.10.2 y por debajo, TIBCO Administrator - Enterprise Edition: versiones 5.11.0 y 5.11.1, TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versiones 5.10.2 y por debajo, TIBCO Administrator - Enterprise Edition Distribution para TIBCO Silver Fabric: versiones 5.11.0 y 5.11.1, TIBCO Administrator - Enterprise Edition para z/Linux: versiones 5.10.2 y por debajo, y TIBCO Administrator - Enterprise Edition para z/Linux: versiones 5.11.0 and 5.11.1, de TIBCO Software Inc

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-03-18 CVE Reserved
2021-04-20 CVE Published
2023-03-08 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.tibco.com/services/support/advisories	2023-11-07
https://www.tibco.com/support/advisories/2021/04/tibco-security-advisory-april-20-2021-tibco-administrator-2021-28828	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				<= 5.10.2 Search vendor "Tibco" for product "Administrator" and version " <= 5.10.2"		enterprise		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				<= 5.10.2 Search vendor "Tibco" for product "Administrator" and version " <= 5.10.2"		enterprise, silver_fabric		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				<= 5.10.2 Search vendor "Tibco" for product "Administrator" and version " <= 5.10.2"		enterprise, z\/linux		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.0 Search vendor "Tibco" for product "Administrator" and version "5.11.0"		enterprise		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.0 Search vendor "Tibco" for product "Administrator" and version "5.11.0"		enterprise, silver_fabric		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.0 Search vendor "Tibco" for product "Administrator" and version "5.11.0"		enterprise, z\/linux		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.1 Search vendor "Tibco" for product "Administrator" and version "5.11.1"		enterprise		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.1 Search vendor "Tibco" for product "Administrator" and version "5.11.1"		enterprise, silver_fabric		Affected
Tibco Search vendor "Tibco"		Administrator Search vendor "Tibco" for product "Administrator"				5.11.1 Search vendor "Tibco" for product "Administrator" and version "5.11.1"		enterprise, z\/linux		Affected