CVE-2018-12408

TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability

Description

The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.

Remediation

Solution:

  • TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO ActiveMatrix BusinessWorks versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks for z/Linux versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions 5.13.0 and below update to version 5.13.1 or higher.

Category

7.5
CVSS
Severity: High
CVSS 3.0 •
CVSS 2.0 •
EPSS 0.43%
Vendor Advisory tibco.com Vendor Advisory tibco.com
Affected: TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks
Affected: TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks for z/Linux
Affected: TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric
Published at:
Updated at:

References

Link Tags
https://www.tibco.com/support/advisories/2018/08/tibco-security-advisory-august-7-2018-tibco-activematrix-businessworks vendor advisory
http://www.tibco.com/services/support/advisories vendor advisory
http://www.securityfocus.com/bid/105043 third party advisory vdb entry

Frequently Asked Questions

What is the severity of CVE-2018-12408?
CVE-2018-12408 has been scored as a high severity vulnerability.
How to fix CVE-2018-12408?
To fix CVE-2018-12408: TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO ActiveMatrix BusinessWorks versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks for z/Linux versions 5.13.0 and below update to version 5.13.1 or higher, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric versions 5.13.0 and below update to version 5.13.1 or higher.
Is CVE-2018-12408 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2018-12408 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2018-12408?
CVE-2018-12408 affects TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks, TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks for z/Linux, TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.