Riskcovery

CVE-2021-35497

TIBCO FTL unvalidated SAN in client certificates

State
Published
Severity
7.5 High
Published
Oct 5, 2021
Updated
Sep 16, 2024
Reserved
Jun 24, 2021

Read the record on cve.org

Description

The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, TIBCO ActiveSpaces - Enterprise Edition, TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative, authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Developer Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.6.1, and 4.6.2, TIBCO FTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO FTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Community Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, TIBCO eFTL - Developer Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0, and TIBCO eFTL - Enterprise Edition: versions 6.2.0, 6.3.0, 6.3.1, 6.4.0, 6.5.0, 6.6.0, 6.6.1, and 6.7.0.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Htibco

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
TIBCO ActiveSpaces - Community EditionTIBCO Software Inc.
  • 4.3.0Affected
  • 4.4.0Affected
  • 4.5.0Affected
  • 4.6.0Affected
  • 4.6.1Affected
  • 4.6.2Affected
TIBCO ActiveSpaces - Developer EditionTIBCO Software Inc.
  • 4.3.0Affected
  • 4.4.0Affected
  • 4.5.0Affected
  • 4.6.0Affected
  • 4.6.1Affected
  • 4.6.2Affected
TIBCO ActiveSpaces - Enterprise EditionTIBCO Software Inc.
  • 4.3.0Affected
  • 4.4.0Affected
  • 4.5.0Affected
  • 4.6.0Affected
  • 4.6.1Affected
  • 4.6.2Affected
TIBCO FTL - Community EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected
TIBCO FTL - Developer EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected
TIBCO FTL - Enterprise EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected
TIBCO eFTL - Community EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected
TIBCO eFTL - Developer EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected
TIBCO eFTL - Enterprise EditionTIBCO Software Inc.
  • 6.2.0Affected
  • 6.3.0Affected
  • 6.3.1Affected
  • 6.4.0Affected
  • 6.5.0Affected
  • 6.6.0Affected
  • 6.6.1Affected
  • 6.7.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.