CVE-2019-8990 TIBCO ActiveMatrix BusinessWorks Fails To Properly Enforce Authentication
Attackers can bypass authentication in TIBCO ActiveMatrix BusinessWorks by exploiting credential reuse in specific HTTP Basic Authentication configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-8990?
CVE-2019-8990 is a critical authentication bypass vulnerability in TIBCO ActiveMatrix BusinessWorks, published on 9 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.
Weakness: CWE-287
Which versions are affected by CVE-2019-8990?
It affects 1 product.
Products include Tibco Activematrix Businessworks.
How do I fix CVE-2019-8990?
No fix has been published for CVE-2019-8990 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-8990 being exploited?
There is no known exploitation of CVE-2019-8990 in the wild and no public exploit code.
Other vulnerabilities in TIBCO ActiveMatrix BusinessWorks
Sources
Also known as GHSA-6fv5-xv88-5c73.