Read the docs
TI-2019-06485 Aliases CVE-2019-8994GHSA-vc4m-fgcj-7cmm

TIBCO ActiveMatrix BPM Escalation of Privileges Vulnerability

Priority LOW 23Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The workspace client of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contains vulnerabilities where an authenticated user can change settings that can theoretically adversely impact other users. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.

Why it matters now

EPSS 0.00782 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIBCOTIBCO ActiveMatrix BPMup to 4.2.0—No fix listedCNA
TIBCOTIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabricup to 4.2.0—No fix listedCNA
TIBCOTIBCO Silver Fabric Enabler for ActiveMatrix BPMup to 1.4.1—No fix listedCNA
  • TIBCO ActiveMatrix BPM VendorTIBCO Affected up to 4.2.0 Fixed in — No fix listed CNA
  • TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric VendorTIBCO Affected up to 4.2.0 Fixed in — No fix listed CNA
  • TIBCO Silver Fabric Enabler for ActiveMatrix BPM VendorTIBCO Affected up to 1.4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:tibco:activematrix_business_process_management:*:*:*:*:*:-:*:*up to 4.2.0VulnerableTIBCO
cpe:2.3:a:tibco:activematrix_business_process_management:*:*:*:*:*:silver_fabric:*:*up to 4.2.0VulnerableTIBCO
cpe:2.3:a:tibco:silver_fabric_enabler:*:*:*:*:*:activematrix_bpm:*:*up to 1.4.1VulnerableTIBCO
  • cpe:2.3:a:tibco:activematrix_business_process_management:*:*:*:*:*:-:*:* Versions up to 4.2.0 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:activematrix_business_process_management:*:*:*:*:*:silver_fabric:*:* Versions up to 4.2.0 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:silver_fabric_enabler:*:*:*:*:*:activematrix_bpm:*:* Versions up to 1.4.1 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-8994
  2. 2026-10-03 Alias added: GHSA-vc4m-fgcj-7cmm

References

Advisory 2

  • TI-2019-08381 TIBCO ActiveMatrix BPM Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences