CVE-2020-9414

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.69%

Published

Jun 30, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79

Affected Products (2)

tibco · managed_file_transfer_command_center (up to 8.2.1)vulnerable

tibco · managed_file_transfer_internet_server (up to 8.2.1)vulnerable

References (2)

http://www.tibco.com/services/support/advisories

Vendor Advisory

http://www.tibco.com/services/support/advisories

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs