TIBCO FTL Windows Platform Artifact Search vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.5.0 and below, TIBCO FTL - Developer Edition: versions 6.5.0 and below, and TIBCO FTL - Enterprise Edition: versions 6.5.0 and below.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO FTL - Community Edition | up to 6.5.0 | — | No fix listed | CNA |
| TIBCO | TIBCO FTL - Developer Edition | up to 6.5.0 | — | No fix listed | CNA |
| TIBCO | TIBCO FTL - Enterprise Edition | up to 6.5.0 | — | No fix listed | CNA |
- TIBCO FTL - Community Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
- TIBCO FTL - Developer Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
- TIBCO FTL - Enterprise Edition VendorTIBCO Affected up to 6.5.0 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:* | before 6.6.0 | Vulnerable | TIBCO |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:tibco:ftl:*:*:*:*:community:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:ftl:*:*:*:*:developer:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:ftl:*:*:*:*:enterprise:*:*:* Versions before 6.6.0 Vulnerable ·TIBCO
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28820
- 2026-10-03 Alias added: GHSA-v377-gg5v-m3pq
References
More TIBCO Ftl vulnerabilities
- TI-2021-19118 TIBCO FTL Secret Generation Vulnerability CVSS 3.1CRITICAL 9.3
- TI-2019-08387 TIBCO FTL Escalation Of Privileges for Realm Configuration CVSS 3.0HIGH 8.8
- TI-2018-08911 TIBCO FTL Realm Server Vulnerable to CSRF Attacks CVSS 3.0HIGH 8.8
- TI-2022-12719 TIBCO FTL Privilege Escalation CVSS 3.1HIGH 8.8
- TI-2021-19119 TIBCO FTL Secret Exposure Vulnerability CVSS 3.1HIGH 8.5
- TI-2021-09810 TIBCO FTL Windows Platform Installation vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2021-28820 · CVE Program
- CVE-2021-28820 · NVD
- FIRST EPSS
- GHSA-v377-gg5v-m3pq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences