TIBCO Managed File Transfer Command Center up to 8.2.1 MFT Browser privileges management

Summaryinfo

A vulnerability was found in TIBCO Managed File Transfer Command Center and Managed File Transfer Internet Server up to 8.2.1. It has been rated as critical. Impacted is an unknown function of the component MFT Browser. This manipulation causes privileges management. This vulnerability is handled as CVE-2020-9413. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in TIBCO Managed File Transfer Command Center and Managed File Transfer Internet Server up to 8.2.1 (File Transfer Software). Affected by this vulnerability is an unknown function of the component MFT Browser. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.

The weakness was released 06/30/2020 (Website). It is possible to read the advisory at tibco.com. This vulnerability is known as CVE-2020-9413 since 02/26/2020. The attack can be launched remotely. The successful exploitation requires a single authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-140389, VDB-143226, VDB-149479 and VDB-150354. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• File Transfer Software

Vendor

• TIBCO

Name

• Managed File Transfer Command Center
• Managed File Transfer Internet Server

Version

• 8.2.0
• 8.2.1

License

• commercial

Website

• Vendor: https://www.tibco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion