CVE-2022-22775 TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability
Low-privileged attackers can execute scripts via reflected XSS in TIBCO BPM Enterprise Workspace client, targeting victims or the system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22775?
CVE-2022-22775 is a high-severity cross-site scripting vulnerability in TIBCO BPM Enterprise, published on 17 May 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.
Weakness: CWE-79
Which versions are affected by CVE-2022-22775?
It affects 2 products.
Products include Tibco Bpm Enterprise, Tibco Bpm Enterprise Distribution for Silver Fabric.
How do I fix CVE-2022-22775?
No fix has been published for CVE-2022-22775 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-22775 being exploited?
There is no known exploitation of CVE-2022-22775 in the wild and no public exploit code.
Other vulnerabilities in TIBCO BPM Enterprise
Sources
Also known as GHSA-vvc8-m435-9334.