CVE-2018-12408 TIBCO ActiveMatrix BusinessWorks 5.X XML eXternal Entity Vulnerability
An attacker can exploit XML External Entity vulnerabilities in TIBCO ActiveMatrix BusinessWorks to disclose the contents of files accessible to the engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12408?
CVE-2018-12408 is a high-severity vulnerability in TIBCO ActiveMatrix BusinessWorks, published on 8 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.
Weakness: CWE-611
Which versions are affected by CVE-2018-12408?
It affects 2 products.
Products include Tibco Activematrix Businessworks, Tibco Activematrix Businessworks Distribution for Tibco Silver Fabric.
How do I fix CVE-2018-12408?
No fix has been published for CVE-2018-12408 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-12408 being exploited?
There is no known exploitation of CVE-2018-12408 in the wild and no public exploit code.
Other vulnerabilities in TIBCO ActiveMatrix BusinessWorks
Sources
Also known as GHSA-x752-5hrq-8pgc.