Read the docs
TI-2018-03948 Aliases CVE-2018-5434GHSA-cp2r-w5fv-px97

XML eXternal Entity Expansion Vulnerabilities with TIBCO Runtime Agent

Priority LOW 31CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.

Summary

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information. Affected releases are TIBCO Software Inc.'s TIBCO Runtime Agent: versions up to and including 5.10.0, and TIBCO Runtime Agent for z/Linux: versions up to and including 5.9.1.

Why it matters now

EPSS 0.01174 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIBCOTIBCO Runtime Agentup to 5.10.0—No fix listedCNA
TIBCOTIBCO Runtime Agent for z/Linuxup to 5.9.1—No fix listedCNA
  • TIBCO Runtime Agent VendorTIBCO Affected up to 5.10.0 Fixed in — No fix listed CNA
  • TIBCO Runtime Agent for z/Linux VendorTIBCO Affected up to 5.9.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tibco:runtime_agent:*:*:*:*:*:linux_kernel:*:*up to 5.9.1VulnerableTIBCO
cpe:2.3:a:tibco:runtime_agent:*:*:*:*:*:*:*:*up to 5.10.0VulnerableTIBCO
  • cpe:2.3:a:tibco:runtime_agent:*:*:*:*:*:linux_kernel:*:* Versions up to 5.9.1 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:runtime_agent:*:*:*:*:*:*:*:* Versions up to 5.10.0 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5434
  2. 2026-10-03 Alias added: GHSA-cp2r-w5fv-px97

References

Advisory 1

  • TI-2008-03199 Multiple buffer overflows in TIBCO Hawk (1) AMI C library (libtibhawkami) and (2) Hawk… CVSS 2.0HIGH 10.0
  • TI-2008-01632 Multiple buffer overflows in TIBCO Software Rendezvous before 8.1.0, as used in multiple… CVSS 2.0HIGH 9.3
  • TI-2021-09818 TIBCO Administrator Stored Cross Site Scripting vulnerability CVSS 3.1CRITICAL 9.6
  • TI-2006-02738 Buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runtime Agent (TRA) before 5.4… CVSS 2.0HIGH 7.5
  • TI-2023-11399 TIBCO Operational Intelligence Hawk RedTail Credential Exposure Vulnerability CVSS 3.1HIGH 8.8
  • TI-2011-00566 Multiple unspecified vulnerabilities in TIBCO Rendezvous 8.2.1 through 8.3.0, Enterprise… CVSS 2.0HIGH 7.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences