CVE-2019-8990

HIGH

TIBCO ActiveMatrix BusinessWorks <= 6.4.2 - Unauthenticated Request Processing via HTTP Basic Authentication Bypass

Title source: llm
STIX 2.1

Description

The HTTP Connector component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks contains a vulnerability that theoretically allows unauthenticated HTTP requests to be processed by the BusinessWorks engine even when authentication is required. This possibility is restricted to circumstances where HTTP "Basic Authentication" policy is used in conjunction with an XML Authentication resource. The BusinessWorks engine might instead use credentials from a prior HTTP request for authorization purposes. Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 6.4.2.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
http://www.tibco.com/services/support/advisories
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107840

Scores

CVSS v3 8.1
EPSS 0.0208
EPSS Percentile 84.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (1)
tibco/activematrix_businessworks < 6.4.2
Published Apr 09, 2019
Tracked Since Feb 18, 2026