CVE-2020-9411 TIBCO Managed File Transfer Platform Server for IBM i Authentication Bypass
Attackers can bypass authentication to read and write files on the server if the 'Require Node Resp' option is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9411?
CVE-2020-9411 is a critical authentication bypass vulnerability in TIBCO Managed File Transfer Platform Server for IBM i, published on 9 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.
Which versions are affected by CVE-2020-9411?
It affects 1 product.
Products include Tibco Managed File Transfer Platform Server.
How do I fix CVE-2020-9411?
No fix has been published for CVE-2020-9411 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-9411 being exploited?
There is no known exploitation of CVE-2020-9411 in the wild and no public exploit code.
Other vulnerabilities in TIBCO Managed File Transfer Platform Server for IBM i
Sources
Also known as GHSA-6j7r-4wh3-ffgh.