CVE-2019-11203 : Security Advisory and Response

TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM have been identified with vulnerabilities in their workspace client, openspace client, app development client, and REST API, including cross-site scripting (XSS) and cross-site request forgery.

Understanding CVE-2019-11203

This CVE involves security vulnerabilities in TIBCO ActiveMatrix BPM and related components.

What is CVE-2019-11203?

The CVE-2019-11203 vulnerability affects TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM, potentially leading to unauthorized access.

The Impact of CVE-2019-11203

The vulnerability could allow unprivileged remote attackers to gain full access to the APIs exposed by the affected ActiveMatrix BPM components.

Technical Details of CVE-2019-11203

This section provides detailed technical information about the CVE.

Vulnerability Description

The vulnerabilities in the workspace client, openspace client, app development client, and REST API of the mentioned TIBCO products include XSS and CSRF vulnerabilities.

Affected Systems and Versions

TIBCO ActiveMatrix BPM versions up to and including 4.2.0
TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric versions up to and including 4.2.0
TIBCO Silver Fabric Enabler for ActiveMatrix BPM versions up to and including 1.4.1

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Scope: Unchanged
CVSS Score: 8.8 (High)

Mitigation and Prevention

Steps to address and prevent the CVE-2019-11203 vulnerability.

Immediate Steps to Take

Update TIBCO ActiveMatrix BPM to version 4.3.0 or higher
Update TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric to version 4.3.0 or higher
Update TIBCO Silver Fabric Enabler for ActiveMatrix BPM to version 1.4.2 or higher

Long-Term Security Practices

Regularly monitor and update software components
Implement security best practices and guidelines

Patching and Updates

TIBCO has released updated versions to address the vulnerabilities
Ensure all affected systems are updated to the recommended versions