CVE-2021-35500

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data Virtualization, and TIBCO Data Virtualization for AWS Marketplace contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to download arbitrary files outside of the scope of the user's permissions on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.3.0 and below, TIBCO Data Virtualization: version 8.4.0, TIBCO Data Virtualization: version 8.5.0, and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.0 and below.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO Data Virtualization	>= unspecified, <= 8.3.0
TIBCO Software Inc.	TIBCO Data Virtualization	8.4.0
TIBCO Software Inc.	TIBCO Data Virtualization	8.5.0
TIBCO Software Inc.	TIBCO Data Virtualization for AWS Marketplace	>= unspecified, <= 8.5.0

References

https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500Vendor Advisory
https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2022/01/tibco-security-advisory-january-12-2022-tibco-data-virtualization-2021-35500Vendor Advisory

Timeline

Published: Jan 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-355015.4PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the c CVE-2021-355029.8app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-temp CVE-2021-355036.1Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.CVE-2021-355047.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.CVE-2021-355057.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.CVE-2021-355066.1Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit CVE-2021-355088.8NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged u CVE-2021-35517.8A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fi CVE-2021-355126.5An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.CVE-2021-355136.1Mermaid before 8.11.0 allows XSS when the antiscript feature is used.CVE-2021-355149.8Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.CVE-2021-355157.5When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop.