TI-2019-08386 Aliases CVE-2019-11208 GHSA-rx4w-m767-65fw

TIBCO API Exchange Processes OAuth Incorrectly

MEDIUM 44Published 2019-08-08 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Why it matters now

EPSS 0.00906 60th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TIBCO	TIBCO API Exchange Gateway	up to 2.3.1	—	No fix listed	CNA
TIBCO	TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric	up to 2.3.1	—	No fix listed	CNA

TIBCO API Exchange Gateway VendorTIBCO Affected up to 2.3.1 Fixed in — No fix listed CNA
TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric VendorTIBCO Affected up to 2.3.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:tibco:api_exchange_gateway::::::::	up to 2.3.1	Vulnerable	TIBCO
cpe:2.3:a:tibco:api_exchange_gateway::::::silver_fabric::*	up to 2.3.1	Vulnerable	TIBCO

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:* Versions up to 2.3.1 Vulnerable ·TIBCO
cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:silver_fabric:*:* Versions up to 2.3.1 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-11208
2026-10-03 Alias added: GHSA-rx4w-m767-65fw

References

Advisory 2

TI-2021-06012 TIBCO API Exchange Gateway Clickjack Vulnerability CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences