LiveActive security incident?Get immediate response
CVE Record

CVE-2019-8993: TIBCO Active Matrix Service Grid Administrator Unauthenticated Download of Sensitive File

The administrative web server component of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, TIBCO ActiveMatrix Policy Director, TIBCO ActiveMatrix Service Bus, TIBCO ActiveMatrix Service Grid, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric, TIBCO Silver Fabric Enabler for ActiveMatrix BPM, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid contains a vulnerability that could theoretically allow an unauthenticated user to download a file with credentials information. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, TIBCO ActiveMatrix Policy Director: versions up to and including 1.1.0, TIBCO ActiveMatrix Service Bus: versions up to and including 3.3.0, TIBCO ActiveMatrix Service Grid: versions up to and including 3.3.1, TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver Fabric: versions up to and including 3.3.0, TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1, and TIBCO Silver Fabric Enabler for ActiveMatrix Service Grid: versions up to and including 1.3.1.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysis

Security readout for executives and security teams

This flaw could let an unauthenticated network user download a file containing credentials from the administrative web server of affected TIBCO ActiveMatrix and Silver Fabric products. The business risk is credential exposure, which can enable follow-on compromise outside the original flaw. Exposure is most likely where affected TIBCO administrative web servers are reachable from untrusted networks. Affected versions include ActiveMatrix BPM through 4.2.0, Policy Director through 1.1.0, Service Bus through 3.3.0, Service Grid through 3.3.1, and listed Silver Fabric distributions/enablers. Treat as a priority if any affected TIBCO administrative interface is reachable by users outside trusted operations networks. The main urgency is preventing credential disclosure and containing possible downstream access. Mitigation focus: Identify all affected TIBCO ActiveMatrix and Silver Fabric deployments.; Review the TIBCO advisory for vendor-approved updates or fixes.; Restrict administrative web server access to trusted management networks..

Prepared

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-8993 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.0HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

8.6High
CVSS 3.0 vector shape for CVE-2019-8993Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TIBCO Software Inc.TIBCO ActiveMatrix BPMunspecifiedListed
TIBCO Software Inc.TIBCO ActiveMatrix BPM Distribution for TIBCO Silver FabricunspecifiedListed
TIBCO Software Inc.TIBCO ActiveMatrix Policy DirectorunspecifiedListed
TIBCO Software Inc.TIBCO ActiveMatrix Service BusunspecifiedListed
TIBCO Software Inc.TIBCO ActiveMatrix Service GridunspecifiedListed
TIBCO Software Inc.TIBCO ActiveMatrix Service Grid Distribution for TIBCO Silver FabricunspecifiedListed
TIBCO Software Inc.TIBCO Silver Fabric Enabler for ActiveMatrix BPMunspecifiedListed
TIBCO Software Inc.TIBCO Silver Fabric Enabler for ActiveMatrix Service GridunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.