Read the docs
TI-2023-11397 Aliases CVE-2023-26217GHSA-6hvj-j96w-8755

TIBCO EBX Add-ons SQL Injection Vulnerability

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

The Data Exchange Add-on component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged user with import permissions and network access to the EBX server to execute arbitrary SQL statements on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 4.5.17 and below, versions 5.6.2 and below, version 6.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00733 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIBCOTIBCO EBX Add-onsup to 4.5.17; up to 5.6.2; 6.1.0—No fix listedCNA
  • TIBCO EBX Add-ons VendorTIBCO Affected up to 4.5.17; up to 5.6.2; 6.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:tibco:ebx_add-ons:*:*:*:*:*:*:*:*up to 4.5.17; 5.0.0 – 5.6.2VulnerableTIBCO
cpe:2.3:a:tibco:ebx_add-ons:6.1.0:*:*:*:*:*:*:*6.1.0VulnerableTIBCO
  • cpe:2.3:a:tibco:ebx_add-ons:*:*:*:*:*:*:*:* Versions up to 4.5.17; 5.0.0 – 5.6.2 Vulnerable ·TIBCO
  • cpe:2.3:a:tibco:ebx_add-ons:6.1.0:*:*:*:*:*:*:* Versions 6.1.0 Vulnerable ·TIBCO

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26217
  2. 2026-10-03 Alias added: GHSA-6hvj-j96w-8755

References

Advisory 1

  • TI-2023-11396 TIBCO EBX Add-ons Arbitrary File Write CVSS 3.1CRITICAL 9.1
  • TI-2022-12724 TIBCO EBX Add-ons Stored XSS vulnerability CVSS 3.1CRITICAL 9.0
  • TI-2022-07018 TIBCO EBX vulnerabilities CVSS 3.1CRITICAL 9.0
  • TI-2022-19971 TIBCO EBX Add-ons Cross Site Scripting (XSS) Vulnerability CVSS 3.1HIGH 8.7
  • TI-2023-11395 TIBCO EBX® Add-ons Path Traversal CVSS 3.1HIGH 7.7
  • TI-2020-16499 TIBCO EBX EXML External Entity CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences