CVE-2020-9417

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-9417
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.tibco.com/services/support/advisories Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:tibco:foresight_archive_and_retrieval_system:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:foresight_archive_and_retrieval_system:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:foresight_operational_monitor:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:foresight_operational_monitor:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:foresight_transaction_insight:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:foresight_transaction_insight:5.2.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:tibco:foresight_archive_and_retrieval_system:*:*:*:*:healthcare:*:*:*
cpe:2.3:a:tibco:foresight_archive_and_retrieval_system:5.2.0:*:*:*:healthcare:*:*:*
cpe:2.3:a:tibco:foresight_operational_monitor:*:*:*:*:healthcare:*:*:*
cpe:2.3:a:tibco:foresight_operational_monitor:5.2.0:*:*:*:healthcare:*:*:*
cpe:2.3:a:tibco:foresight_transaction_insight:*:*:*:*:healthcare:*:*:*
cpe:2.3:a:tibco:foresight_transaction_insight:5.2.0:*:*:*:healthcare:*:*:*
History

No history.

Information

Published : 2020-10-20 21:15

Updated : 2023-12-10 13:41

NVD link : CVE-2020-9417

Mitre link : CVE-2020-9417

CVE.ORG link : CVE-2020-9417

JSON object : View

Products Affected

tibco

  • foresight_archive_and_retrieval_system
  • foresight_transaction_insight
  • foresight_operational_monitor
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')