CVE-2019-11203

TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities

State: Published
Severity: 8.8 High
Published: Apr 24, 2019
Updated: Sep 16, 2024
Reserved: Apr 12, 2019

Description

The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.

Scores

CVSS	Score	Vector	Source
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	tibco

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
TIBCO ActiveMatrix BPMTIBCO Software Inc.	4.2.0 and earlierAffected
TIBCO ActiveMatrix BPM Distribution for TIBCO Silver FabricTIBCO Software Inc.	4.2.0 and earlierAffected
TIBCO Silver Fabric Enabler for ActiveMatrix BPMTIBCO Software Inc.	1.4.1 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.