TI-2021-06012 Aliases CVE-2021-23274 GHSA-3ffw-g5rc-2f2v

TIBCO API Exchange Gateway Clickjack Vulnerability

MEDIUM 44CWE-1021Published 2021-03-23 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1021.

Summary

The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO API Exchange Gateway: versions 2.3.3 and below and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric: versions 2.3.3 and below.

Why it matters now

EPSS 0.01218 68th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TIBCO	TIBCO API Exchange Gateway	up to 2.3.3	—	No fix listed	CNA
TIBCO	TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric	up to 2.3.3	—	No fix listed	CNA

TIBCO API Exchange Gateway VendorTIBCO Affected up to 2.3.3 Fixed in — No fix listed CNA
TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric VendorTIBCO Affected up to 2.3.3 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:tibco:api_exchange_gateway::::::::	up to 2.3.3	Vulnerable	TIBCO
cpe:2.3:a:tibco:api_exchange_gateway_distribution::::::silver_fabric::*	up to 2.3.3	Vulnerable	TIBCO

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:* Versions up to 2.3.3 Vulnerable ·TIBCO
cpe:2.3:a:tibco:api_exchange_gateway_distribution:*:*:*:*:*:silver_fabric:*:* Versions up to 2.3.3 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-23274
2026-10-03 Alias added: GHSA-3ffw-g5rc-2f2v

References

Advisory 2

TI-2019-08386 TIBCO API Exchange Processes OAuth Incorrectly CVSS 3.1CRITICAL 9.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences