CoreCVE
Back

CRITICAL

TIBCO API Exchange Processes OAuth Incorrectly

Published Aug 8, 2019

Description

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Affected products

Remediation

Vendor solution

TIBCO has released updated versions of the affected systems which address these issues.

TIBCO API Exchange Gateway versions 2.3.1 and below update to version 2.3.2 or higher TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and below update to version 2.3.2 or higher

Weaknesses (0)

No CWE recorded.

References (3)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner tibco
Published Aug 8, 2019
Updated Sep 17, 2024
Reserved Apr 12, 2019
Link CVE-2019-11208
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-11208
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-11208
ENISA EUVD
Assigner tibco
Published Aug 8, 2019
Updated Sep 17, 2024
Exploited since n/a
Link EUVD-2019-2909
EUVD-2019-2909