CVE-2023-26216 TIBCO EBX Add-ons Arbitrary File Write
An attacker can upload arbitrary files to the web server directory, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26216?
CVE-2023-26216 is a critical path traversal vulnerability in TIBCO EBX Add-ons, published on 25 May 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an exploitable vulnerability that allows an attacker to upload files to a directory accessible by the web server. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.16 and below.
Weakness: CWE-22
Which versions are affected by CVE-2023-26216?
It affects 1 product.
Products include Tibco Ebx Add-Ons.
How do I fix CVE-2023-26216?
No fix has been published for CVE-2023-26216 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-26216 being exploited?
There is no known exploitation of CVE-2023-26216 in the wild and no public exploit code.
Other vulnerabilities in TIBCO EBX Add-ons
- CVE-2023-26217 TIBCO EBX Add-ons SQL Injection Vulnerability
- CVE-2022-41566 TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability
- CVE-2022-30578 TIBCO EBX Add-ons Stored XSS vulnerability
- CVE-2023-26215 TIBCO EBX® Add-ons Path Traversal
- CVE-2019-17331 TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities
Sources
Also known as GHSA-rrxj-c2rq-pqr4.