CVE-2022-22772

TIBCO Managed File Transfer Platform Server Remote Code Execution Vulnerability

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The cfsend, cfrecv, and CyberResp components of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX and TIBCO Managed File Transfer Platform Server for z/Linux contain a difficult to exploit Remote Code Execution (RCE) vulnerability that allows a low privileged attacker with network access to execute arbitrary code on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX: versions 8.1.0 and below and TIBCO Managed File Transfer Platform Server for z/Linux: versions 8.1.0 and below.

Los componentes cfsend, cfrecv y CyberResp de TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX y TIBCO Managed File Transfer Platform Server for z/Linux contienen una vulnerabilidad de Ejecución de Código Remota (RCE) difícil de explotar que permite a un atacante con pocos privilegios y acceso a la red ejecutar código arbitrario en el sistema afectado. Las versiones afectadas son TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for UNIX: versiones 8.1.0 y anteriores y TIBCO Managed File Transfer Platform Server for z/Linux: versiones 8.1.0 y anteriores

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-01-07 CVE Reserved
2022-03-30 CVE Published
2024-06-21 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.tibco.com/services/support/advisories	2022-04-07
https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-30-2022-tibco-managed-file-transfer-2022-22772	2022-04-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tibco Search vendor "Tibco"	Managed File Transfer Platform Server Search vendor "Tibco" for product "Managed File Transfer Platform Server"	< 8.1.1 Search vendor "Tibco" for product "Managed File Transfer Platform Server" and version " < 8.1.1"	-	Affected	in	Ibm Search vendor "Ibm"	Z Linux Search vendor "Ibm" for product "Z Linux"	-	-	Safe
Tibco Search vendor "Tibco"	Managed File Transfer Platform Server Search vendor "Tibco" for product "Managed File Transfer Platform Server"	< 8.1.1 Search vendor "Tibco" for product "Managed File Transfer Platform Server" and version " < 8.1.1"	-	Affected	in	Opengroup Search vendor "Opengroup"	Unix Search vendor "Opengroup" for product "Unix"	-	-	Safe