CVE-2022-30573 - OpenCVE

The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO FTL - Enterprise Edition: version 6.8.0.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tibco	Ftl

Configuration 1 [-]

OR	cpe:2.3:a:tibco:ftl:::::enterprise:::*
	cpe:2.3:a:tibco:ftl:::::community:::*
	cpe:2.3:a:tibco:ftl:::::developer:::*
	cpe:2.3:a:tibco:ftl:6.8.0::::enterprise:::

No data.

References

Link	Providers
https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573

History

No history.

MITRE

Status: PUBLISHED

Assigner: tibco

Published: 2022-08-09T17:20:11.921396Z

Updated: 2024-09-16T16:48:53.136Z

Reserved: 2022-05-11T00:00:00

Link: CVE-2022-30573

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-08-09T18:15:08.283

Modified: 2022-08-11T23:15:27.637

Link: CVE-2022-30573

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "TIBCO FTL - Community Edition", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.8.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO FTL - Developer Edition", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.8.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO FTL - Enterprise Edition", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.7.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO FTL - Enterprise Edition", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "6.8.0"}]}], "datePublic": "2022-08-09T00:00:00", "descriptions": [{"lang": "en", "value": "The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO FTL - Enterprise Edition: version 6.8.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-08-09T18:06:22", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"}], "title": "TIBCO FTL Privilege Escalation", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2022-08-09T17:00:00Z", "ID": "CVE-2022-30573", "STATE": "PUBLIC", "TITLE": "TIBCO FTL Privilege Escalation"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO FTL - Community Edition", "version": {"version_data": [{"version_affected": "<=", "version_value": "6.8.0"}]}}, {"product_name": "TIBCO FTL - Developer Edition", "version": {"version_data": [{"version_affected": "<=", "version_value": "6.8.0"}]}}, {"product_name": "TIBCO FTL - Enterprise Edition", "version": {"version_data": [{"version_affected": "<=", "version_value": "6.7.3"}]}}, {"product_name": "TIBCO FTL - Enterprise Edition", "version": {"version_data": [{"version_affected": "=", "version_value": "6.8.0"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO FTL - Enterprise Edition: version 6.8.0."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Successful exploitation of this vulnerability may result in an attacker gaining full administrative access to the affected ftlserver."}]}]}, "references": {"reference_data": [{"name": "https://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "https://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO FTL - Community Edition versions 6.0.0 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Developer Edition versions 6.0.1 through 6.8.0: update to version 6.8.1 or later\nTIBCO FTL - Enterprise Edition versions 6.0.0 through 6.7.3: update to version 6.7.4 or later\nTIBCO FTL - Enterprise Edition version 6.8.0: update to version 6.8.1 or later"}], "source": {"discovery": ""}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:56:12.870Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2022-30573", "datePublished": "2022-08-09T17:20:11.921396Z", "dateReserved": "2022-05-11T00:00:00", "dateUpdated": "2024-09-16T16:48:53.136Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C70CD63C-4E67-4067-BE61-A3F0F20B2FF7", "versionEndIncluding": "6.7.3", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:*", "matchCriteriaId": "E763FF1F-EA73-42AB-A975-0CE765265662", "versionEndIncluding": "6.8.0", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:*", "matchCriteriaId": "91D694DE-7F31-4CBC-9A17-E16DD136979E", "versionEndIncluding": "6.8.0", "versionStartIncluding": "6.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:ftl:6.8.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "68E1EA1B-8795-4E53-A2BB-39162B53A1D9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO FTL - Enterprise Edition: version 6.8.0."}, {"lang": "es", "value": "El componente ftlserver de TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, y TIBCO FTL - Enterprise Edition contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante poco privilegiado y acceso a la red ejecutar una escalada de privilegios en el ftlserver afectado. Las versiones afectadas son TIBCO FTL - Community Edition de TIBCO Software Inc.: versiones 6.0.0 hasta 6.8.0, TIBCO FTL - Developer Edition: versiones 6.0.1 hasta 6.8.0, TIBCO FTL - Enterprise Edition: versiones 6.0.0 hasta 6.7.3, y TIBCO FTL - Enterprise Edition: versi\u00f3n 6.8.0"}], "id": "CVE-2022-30573", "lastModified": "2022-08-11T23:15:27.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security@tibco.com", "type": "Secondary"}]}, "published": "2022-08-09T18:15:08.283", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/08/tibco-security-advisory-august-9-2022-tibco-ftl-cve-2022-30573"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}