CVE-2021-28824

The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.5.0 and below, TIBCO ActiveSpaces - Developer Edition: versions 4.5.0 and below, and TIBCO ActiveSpaces - Enterprise Edition: versions 4.5.0 and below.

CVSS v3 8.8 HIGH
CVSS v2.0 4.6 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.tibco.com/services/support/advisories	Vendor Advisory
http://www.tibco.com/services/support/advisories	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tibco:activespaces:::::community:::*
	cpe:2.3:a:tibco:activespaces:::::developer:::*
	cpe:2.3:a:tibco:activespaces:::::enterprise:::*

History

No history.

Information

Published : 2021-03-23 21:15

Updated : 2024-11-21 06:00

NVD link : CVE-2021-28824

Mitre link : CVE-2021-28824

CVE.ORG link : CVE-2021-28824

JSON object : View

Products Affected

tibco

activespaces

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2021-28824", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security@tibco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "published": "2021-03-23T21:15:14.260", "references": [{"url": "http://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}, {"url": "http://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Windows Installation component of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edition, and TIBCO ActiveSpaces - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.5.0 and below, TIBCO ActiveSpaces - Developer Edition: versions 4.5.0 and below, and TIBCO ActiveSpaces - Enterprise Edition: versions 4.5.0 and below."}, {"lang": "es", "value": "El componente de Instalaci\u00f3n de Windows de TIBCO ActiveSpaces - Community Edition de TIBCO Software Inc., TIBCO ActiveSpaces - Developer Edition y TIBCO ActiveSpaces - Enterprise Edition, contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante poco privilegiado con acceso local en algunas versiones del sistema operativo Windows insertar software malicioso. Se puede abusar del componente afectado para ejecutar el software malicioso insertado por el atacante con los privilegios elevados del componente. Esta vulnerabilidad es debido a una falta de restricciones de acceso a determinados archivos y/o carpetas en la instalaci\u00f3n. Las versiones afectadas son TIBCO ActiveSpaces - Community Edition de TIBCO Software Inc.: versiones 4.5.0 y por debajo, TIBCO ActiveSpaces - Developer Edition: versiones 4.5.0 y por debajo, y TIBCO ActiveSpaces - Enterprise Edition: versiones 4.5"}], "lastModified": "2024-11-21T06:00:16.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:activespaces:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "5369E364-E23B-4DE0-9710-FDD1D7CDEEC3", "versionEndExcluding": "4.6.0"}, {"criteria": "cpe:2.3:a:tibco:activespaces:*:*:*:*:developer:*:*:*", "vulnerable": true, "matchCriteriaId": "DBD505A8-5DD9-4D8F-A9D8-1331D4A8D4C9", "versionEndExcluding": "4.6.0"}, {"criteria": "cpe:2.3:a:tibco:activespaces:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "30110FB4-92BB-4DAE-9AF1-374DFDD6A157", "versionEndExcluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@tibco.com"}