CVE Published: 16/11/2021 |
CVE Updated: 16/09/2024 |
CVE Year: 2021 Source: tibco |
Vendor: TIBCO Software Inc. |
Product: TIBCO PartnerExpress Status : PUBLISHED
CVE-2021-43047 Description
The Interior Server and Gateway Server components of TIBCO Software Inc.\'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim\'s local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\'s TIBCO PartnerExpress: versions 6.2.1 and below.
Metrics
CVSS Version: 3.1 |
Base Score: 9 CRITICAL Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
l➤ Impact Metrics: Confidentiality Impact (C)* HIGH Integrity Impact (I)* HIGH Availability Impact (A)* HIGH
Weakness Enumeration (CWE)
CWE-ID: CWE Name: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system or the victim
s local system. Source: TIBCO Software Inc.
Common Attack Pattern Enumeration and Classification (CAPEC)