CVE-2021-35498
Description
The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.
How to fix
- tibco ebx5.8.124, 5.9.15, 6.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tibco product_and_service_catalog_powered_by_tibco_ebx | 1.0.0 | — |
| tibco ebx | v < 5.8.124, 5.9.3 ≤ v < 5.9.15, 6.0.0 ≤ v < 6.0.2 | 5.8.124, 5.9.15, 6.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.