CVE-2019-11208

TIBCO API Exchange Processes OAuth Incorrectly

Description

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Remediation

Solution:

TIBCO has released updated versions of the affected systems which address these issues. TIBCO API Exchange Gateway versions 2.3.1 and below update to version 2.3.2 or higher TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and below update to version 2.3.2 or higher

9.9

CVSS

Severity: Critical

CVSS 3.1 •

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.17%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO API Exchange Gateway

Affected: TIBCO Software Inc. TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric

References

Link	Tags
http://www.tibco.com/services/support/advisories	vendor advisory
https://www.tibco.com/support/advisories/2019/08/tibco-security-advisory-august-7-2019-tibco-api-exchange	issue tracking vendor advisory

Frequently Asked Questions

What is the severity of CVE-2019-11208?: CVE-2019-11208 has been scored as a critical severity vulnerability.
How to fix CVE-2019-11208?: To fix CVE-2019-11208: TIBCO has released updated versions of the affected systems which address these issues. TIBCO API Exchange Gateway versions 2.3.1 and below update to version 2.3.2 or higher TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and below update to version 2.3.2 or higher
Is CVE-2019-11208 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-11208 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-11208?: CVE-2019-11208 affects TIBCO Software Inc. TIBCO API Exchange Gateway, TIBCO Software Inc. TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric.