CVE-2020-9412

TIBCO Managed File Transfer Platform Server for IBM i Arbitrary Command Execution

Description

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.

Remediation

Solution:

TIBCO has released updated versions of the affected components which address these issues. TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below update to version 7.1.1 or higher TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 update to version 8.0.1 or higher

10.0

CVSS

Severity: Critical

CVSS 3.1 •

CVSS 2.0 •

EPSS 0.78% Top 30%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO Managed File Transfer Platform Server for IBM i

References

Link	Tags
https://www.tibco.com/services/support/advisories	vendor advisory mailing list
https://www.tibco.com/support/advisories/2020/06/tibco-security-advisory-june-9-2020-tibco-managed-file-transfer-2020-9412	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-9412?: CVE-2020-9412 has been scored as a critical severity vulnerability.
How to fix CVE-2020-9412?: To fix CVE-2020-9412: TIBCO has released updated versions of the affected components which address these issues. TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 and below update to version 7.1.1 or higher TIBCO Managed File Transfer Platform Server for IBM i version 8.0.0 update to version 8.0.1 or higher
Is CVE-2020-9412 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2020-9412 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-9412?: CVE-2020-9412 affects TIBCO Software Inc. TIBCO Managed File Transfer Platform Server for IBM i.