CVE-2023-26217

TIBCO EBX Add-ons SQL Injection Vulnerability

State: Published
Severity: 8.8 High
Published: Jul 19, 2023
Updated: Oct 24, 2024
Reserved: Feb 20, 2023

Description

The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	tibco

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
TIBCO EBX Add-onsTIBCO Software Inc.	4.5.17 and earlierAffected 5.6.2 and earlierAffected 6.1.0Affected

References

https://www.tibco.com/services/support/advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.