Read the docs
TI-2024-09475 Aliases CVE-2024-10218GHSA-gcg5-h35m-25rv

TIBCO Hawk Stored-XEE Vulnerability

Priority MEDIUM 40CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed TIBCO Hawk (TIBCO Software Inc): 5TIBCO Operational Intelligence (TIBCO Software Inc): 0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIBCOTIBCO Hawk6.2 to before 55Patch availableCNA
TIBCOTIBCO Operational Intelligence7.3 to before 00Patch availableCNA
  • TIBCO Hawk VendorTIBCO Affected 6.2 to before 5 Fixed in 5 Patch available CNA
  • TIBCO Operational Intelligence VendorTIBCO Affected 7.3 to before 0 Fixed in 0 Patch available CNA

Remediation

  • Fix · CNA TIBCO Hawk (TIBCO Software Inc) Fixed in 5
  • Fix · CNA TIBCO Operational Intelligence (TIBCO Software Inc) Fixed in 0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    TIBCO Hawk, TIBCO Operational Intelligence 0, 5

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-09474 TIBCO Hawk Stored-XSS VulnerabilityPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10218
  2. 2026-10-03 Alias added: GHSA-gcg5-h35m-25rv

References

Other 1

  • TI-2018-03944 TIBCO JasperReports Server Information Disclosure Vulnerability KEVCVSS 3.1HIGH 8.8
  • TI-2018-13320 TIBCO JasperReports Library Directory Traversal Vulnerability KEVCVSS 3.1MEDIUM 6.5
  • TI-2009-01226 Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product… CVSS 2.0HIGH 10.0
  • TI-2007-05438 Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks… CVSS 2.0HIGH 10.0
  • TI-2023-13668 TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2008-01633 Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before… CVSS 2.0HIGH 10.0
See all 235 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences