CVE-2021-35498

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered by TIBCO EBX contains a vulnerability that under certain specific conditions allows an attacker to enter a password other than the legitimate password and it will be accepted as valid. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.123 and below, TIBCO EBX: versions 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9, 5.9.10, 5.9.11, 5.9.12, 5.9.13, and 5.9.14, TIBCO EBX: versions 6.0.0 and 6.0.1, and TIBCO Product and Service Catalog powered by TIBCO EBX: version 1.0.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO EBX	>= unspecified, <= 5.8.123
TIBCO Software Inc.	TIBCO EBX	5.9.3; 5.9.4; 5.9.5; 5.9.6; 5.9.7; 5.9.8; 5.9.9; 5.9.10; 5.9.11; 5.9.12; 5.9.13; 5.9.14
TIBCO Software Inc.	TIBCO EBX	6.0.0; 6.0.1
TIBCO Software Inc.	TIBCO Product and Service Catalog powered by TIBCO EBX	1.0.0

References

https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-13-2021-tibco-ebx-2021-35498Vendor Advisory
https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-13-2021-tibco-ebx-2021-35498Vendor Advisory

Timeline

Published: Oct 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-354995.4The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilit CVE-2021-35507.8A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation.CVE-2021-355005.5The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualiz CVE-2021-355015.4PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the c CVE-2021-355029.8app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-temp CVE-2021-355036.1Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.CVE-2021-355047.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.CVE-2021-355057.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.CVE-2021-355066.1Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit CVE-2021-355088.8NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged u CVE-2021-35517.8A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fi CVE-2021-355126.5An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.