CVE-2021-35498

TIBCO EBX Insecure Login Mechanism

State: Published
Severity: 9.8 Critical
Published: Oct 13, 2021
Updated: Sep 16, 2024
Reserved: Jun 24, 2021

Description

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	tibco

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
TIBCO EBXTIBCO Software Inc.	5.8.123 and earlierAffected
TIBCO EBXTIBCO Software Inc.	5.9.3Affected 5.9.4Affected 5.9.5Affected 5.9.6Affected 5.9.7Affected 5.9.8Affected 5.9.9Affected 5.9.10Affected 5.9.11Affected 5.9.12Affected 5.9.13Affected 5.9.14Affected
TIBCO EBXTIBCO Software Inc.	6.0.0Affected 6.0.1Affected
TIBCO Product and Service Catalog powered by TIBCO EBXTIBCO Software Inc.	1.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.