Read the docs
TI-2021-19120 Aliases CVE-2021-43054GHSA-82jh-wrjm-pc23

TIBCO eFTL Token Generation Vulnerability

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.

Why it matters now

EPSS 0.00771 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIBCOTIBCO eFTL - Community Editionup to 6.7.2—No fix listedCNA
TIBCOTIBCO eFTL - Developer Editionup to 6.7.2—No fix listedCNA
TIBCOTIBCO eFTL - Enterprise Editionup to 6.7.2—No fix listedCNA
  • TIBCO eFTL - Community Edition VendorTIBCO Affected up to 6.7.2 Fixed in — No fix listed CNA
  • TIBCO eFTL - Developer Edition VendorTIBCO Affected up to 6.7.2 Fixed in — No fix listed CNA
  • TIBCO eFTL - Enterprise Edition VendorTIBCO Affected up to 6.7.2 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:*up to 6.7.2VulnerableTIBCO
cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:*up to 6.7.2VulnerableTIBCO
cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:*up to 6.7.2VulnerableTIBCO
  • cpe:2.3:a:tibco:eftl:*:*:*:*:community:*:*:* Versions up to 6.7.2 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:eftl:*:*:*:*:developer:*:*:* Versions up to 6.7.2 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:eftl:*:*:*:*:enterprise:*:*:* Versions up to 6.7.2 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43054
  2. 2026-10-03 Alias added: GHSA-82jh-wrjm-pc23

References

Advisory 2

  • TI-2021-19121 TIBCO eFTL Token Caching Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-09814 TIBCO eFTL Windows Platform Installation vulnerability CVSS 3.1HIGH 8.8
  • TI-2022-12720 TIBCO eFTL Secret Jacking CVSS 3.1HIGH 7.8
  • TI-2021-14235 TIBCO FTL unvalidated SAN in client certificates CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences