LiveActive security incident?Get immediate response
CVE Record

CVE-2020-9412: TIBCO Managed File Transfer Platform Server for IBM i Arbitrary Command Execution

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.

CriticalCVSS 10Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2020-9412 affects TIBCO Managed File Transfer Platform Server for IBM i. A failed file transfer can theoretically lead to arbitrary command execution with the affected system's privileges. The CVSS score is 10.0, so exposed affected servers should be treated as urgent business risk.

Executive priority

Treat as urgent where the product is deployed. A vulnerable MFT server could allow full system-level compromise, affecting sensitive transferred data, business operations, and trust with partners.

Technical view

The vulnerable file transfer component may permit network-based, unauthenticated arbitrary command execution after a failed file transfer. Affected versions are 7.1.0 and below, and 8.0.0. The supplied sources do not identify a CWE or provide detailed root cause, exploit procedure, or remediation text.

Likely exposure

Exposure is limited to organizations running TIBCO Managed File Transfer Platform Server for IBM i versions 7.1.0 or below, or 8.0.0. Internet-facing or partner-accessible MFT systems carry higher practical risk.

Exploitation context

The CVE is not listed as CISA KEV in the supplied bundle, and no cited source states active exploitation. The issue is still severe because the CVSS vector indicates remote, unauthenticated, low-complexity impact across confidentiality, integrity, and availability.

Researcher notes

The public description is sparse and uses the word theoretically. Avoid assuming exploit availability or specific attack mechanics. The key research tasks are asset confirmation, version validation, exposure review, and vendor-advisory correlation.

Mitigation direction

  • Identify all IBM i hosts running the affected TIBCO MFT product.
  • Check TIBCO's advisory and support guidance for fixed releases or supported workarounds.
  • Prioritize upgrade or vendor-approved remediation for exposed systems.
  • Restrict network access to trusted transfer partners until remediation is complete.
  • Monitor failed transfer events and related system command activity.

Validation and detection

  • Confirm installed TIBCO MFT Platform Server for IBM i versions.
  • Compare versions against affected releases: 7.1.0 and below, and 8.0.0.
  • Review whether the service is reachable from the internet or external partner networks.
  • Check recent failed file transfer logs for unusual follow-on system activity.
  • Verify remediation status against TIBCO advisory records.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-9412 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
10 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
10CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

10Critical
CVSS 3.1 vector shape for CVE-2020-9412Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
TIBCO Software Inc.TIBCO Managed File Transfer Platform Server for IBM iunspecified, 8.0.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.