CVE-2018-12414 Information

Description

The Rendezvous Routing Daemon (rvrd) Rendezvous Secure Routing Daemon (rvrsd) Rendezvous Secure Daemon (rvsd) Rendezvous Cache (rvcache) and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.’s TIBCO Rendezvous TIBCO Rendezvous Developer Edition TIBCO Rendezvous for z/Linux TIBCO Rendezvous for z/OS TIBCO Rendezvous Network Server TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.’s TIBCO Rendezvous: versions up to and including 8.4.5 TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5 TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5 TIBCO Rendezvous for z/OS: versions up to and including 8.4.5 TIBCO Rendezvous Network Server: versions up to and including 1.1.2 and TIBCO Substation ES: versions up to and including 2.12.2.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

http://www.securityfocus.com/bid/105871 http://www.tibco.com/services/support/advisories https://www.tibco.com/support/advisories/2018/11/tibco-security-advisory-november-6-2018-tibco-rendezvous

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8