Cross-site scripting (XSS) vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• tibco managed file transfer command centerup to 7.1.0 inclusive
• tibco managed file transfer command center6.7
• tibco managed file transfer command center7.0
• tibco managed file transfer command center7.0.1
• tibco managed file transfer internet serverup to 7.1.0 inclusive
• tibco managed file transfer internet server6.7
• tibco managed file transfer internet server7.0
• tibco managed file transfer internet server7.0.1
• tibco slingshotup to 1.8.0 inclusive

Other highest-scoring records for the same primary product.

• CVE-2018-18810TIBCO Managed File Transfer Credentials Disclosure
  39Monitor
• CVE-2020-9413TIBCO Managed File Transfer reflected XSS vulerability
  38Monitor
• CVE-2022-22774TIBCO Managed File Transfer Command Center XXE Vulnerability
  36Monitor
• CVE-2020-9414TIBCO Managed File Transfer reflected XSS vulerability
  36Monitor
• CVE-2017-5531Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions
  35Monitor
• CVE-2011-3424Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed F
  17Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User content is inserted into the page as HTML. The browser interprets the content as code rather than data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1commentEl.innerHTML = comment.body;

1commentEl.textContent = comment.body;

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.