TIBCO Session Fixation and Multiple Input Validation Vulnerabilities
BID:45691
Info
TIBCO Session Fixation and Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 45691 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4496 CVE-2010-4497 CVE-2010-4498 CVE-2010-4499 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 06 2011 12:00AM |
| Updated: | Jan 06 2011 12:00AM |
| Credit: | Reported by the vendor |
| Vulnerable: |
TIBCO Collaborative Information Manager 8.0 TIBCO ActiveCatalog 1.0 |
| Not Vulnerable: |
TIBCO Collaborative Information Manager 8.1 TIBCO ActiveCatalog 1.0.1 |
Discussion
TIBCO Session Fixation and Multiple Input Validation Vulnerabilities
TIBCO Collaborative Information Manager and ActiveCatalog is prone to multiple vulnerabilities, including SQL-injection, cross-site scripting, information-disclosure, and session-fixation issues.
Successful exploits of these vulnerabilities can allow attackers to compromise the applications, access or modify data, exploit latent vulnerabilities in the underlying database, execute arbitrary script code in a user's browser in the context of the webserver process, access sensitive data, or hijack a user's session.
The following products are vulnerable:
TIBCO Collaborative Information Manager versions prior to 8.1.0
TIBCO ActiveCatalog versions prior to 1.0.1
TIBCO Collaborative Information Manager and ActiveCatalog is prone to multiple vulnerabilities, including SQL-injection, cross-site scripting, information-disclosure, and session-fixation issues.
Successful exploits of these vulnerabilities can allow attackers to compromise the applications, access or modify data, exploit latent vulnerabilities in the underlying database, execute arbitrary script code in a user's browser in the context of the webserver process, access sensitive data, or hijack a user's session.
The following products are vulnerable:
TIBCO Collaborative Information Manager versions prior to 8.1.0
TIBCO ActiveCatalog versions prior to 1.0.1
Exploit / POC
TIBCO Session Fixation and Multiple Input Validation Vulnerabilities
An attacker can exploit these issues using a browser. To exploit some of the issues, the attacker needs to entice a user to follow a malicious URI.
An attacker can exploit these issues using a browser. To exploit some of the issues, the attacker needs to entice a user to follow a malicious URI.
Solution / Fix
References
TIBCO Session Fixation and Multiple Input Validation Vulnerabilities
References:
References:
- TIBCO ActiveCatalog Manual (TIBCO)
- TIBCO Collaborative Information Manager Homepage (TIBCO)
- TIBCO Homepage (TIBCO)
- TIBCO Security Advisory (TIBCO)
- TIBCO Vulnerability Reference (TIBCO)