TIBCO FTL Windows Platform Installation vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.5.0 and below, TIBCO FTL - Developer Edition: versions 6.5.0 and below, and TIBCO FTL - Enterprise Edition: versions 6.5.0 and below.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO FTL - Community Edition | up to 6.5.0 | — | No fix listed | CNA |
| TIBCO | TIBCO FTL - Developer Edition | up to 6.5.0 | — | No fix listed | CNA |
| TIBCO | TIBCO FTL - Enterprise Edition | up to 6.5.0 | — | No fix listed | CNA |
- TIBCO FTL - Community Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
- TIBCO FTL - Developer Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
- TIBCO FTL - Enterprise Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28819
- 2026-10-03 Alias added: GHSA-px8h-hw5w-ghg6
References
More TIBCO Ftl vulnerabilities
- TI-2021-19118 TIBCO FTL Secret Generation Vulnerability CVSS 3.1CRITICAL 9.3
- TI-2019-08387 TIBCO FTL Escalation Of Privileges for Realm Configuration CVSS 3.0HIGH 8.8
- TI-2018-08911 TIBCO FTL Realm Server Vulnerable to CSRF Attacks CVSS 3.0HIGH 8.8
- TI-2022-12719 TIBCO FTL Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2021-19119 TIBCO FTL Secret Exposure Vulnerability CVSS 3.1HIGH 8.5
- TI-2021-09811 TIBCO FTL Windows Platform Artifact Search vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2021-28819 · CVE Program
- CVE-2021-28819 · NVD
- FIRST EPSS
- GHSA-px8h-hw5w-ghg6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences