CVE-2020-9411

TIBCO Managed File Transfer Platform Server for IBM i Authentication Bypass

Description

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.

Remediation

Solution:

TIBCO has released updated versions of the affected components which address these issues. TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below update to version 7.1.1 or higher TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 update to version 8.0.1 or higher

10.0

CVSS

Severity: Critical

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.39%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO Managed File Transfer Platform Server for IBM i

References

Link	Tags
https://www.tibco.com/services/support/advisories	vendor advisory
https://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-9-2020-tibco-managed-file-transfer-2020-9411	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-9411?: CVE-2020-9411 has been scored as a critical severity vulnerability.
How to fix CVE-2020-9411?: To fix CVE-2020-9411: TIBCO has released updated versions of the affected components which address these issues. TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below update to version 7.1.1 or higher TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 update to version 8.0.1 or higher
Is CVE-2020-9411 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-9411 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-9411?: CVE-2020-9411 affects TIBCO Software Inc. TIBCO Managed File Transfer Platform Server for IBM i.