TIBCO EBX Add-on For Data Exchange Cross-Site Scripting Vulnerabilities

Published 6 y ago 2019-11-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.3

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 49%

Public exploits

none known

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theoretically allows authenticated users to perform stored cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions up to and including 3.20.13, version 4.1.0.

Exploit prediction (EPSS)

0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.3	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`
NVD	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
CNA	3.0	7.3	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:N/I:P/A:N`

Affected products

TIBCO Software Inc. TIBCO EBX Add-ons

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

tibco.com /services/support/advisories · x_refsource_MISC, x_transferred
tibco.com /support/advisories/2019/11/tibco-security-advisory-november-12-2019-tibco-ebx-add-on-2019 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-17331
NVD: CVE-2019-17331

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.