{"schemaVersion":3,"id":"CVE-2018-12408","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric contains a vulnerability that may allow XML eXternal Entity (XXE) attacks via incoming network messages, and may disclose the contents of files accessible to a running BusinessWorks engine Affected releases are TIBCO Software Inc. TIBCO ActiveMatrix BusinessWorks: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks for z/Linux: versions up to and including 5.13.0, TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric: versions up to and including 5.13.0.","dates":{"published":"2018-08-08T14:00:00.000Z","modified":"2024-09-17T02:56:30.441Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.0","versionLabel":"v3.0","source":"CVE.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":5,"severity":"medium","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02347,"percentile":0.83413,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.02999999999999982,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02377},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02347,"percentile":0.83413}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02377,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02347,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02347,"percentile":0.83413}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"tibco software inc.","product":"tibco activematrix businessworks","name":"TIBCO ActiveMatrix BusinessWorks","label":"tibco activematrix businessworks","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ 5.13.0","eol":null,"hubHref":"/vendor/tibco_software_inc/tibco_activematrix_businessworks"},{"vendor":"tibco software inc.","product":"tibco activematrix businessworks distribution for tibco silver fabric","name":"TIBCO ActiveMatrix BusinessWorks Distribution for TIBCO Silver Fabric","label":"tibco activematrix businessworks distribution for tibco silver fabric","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ 5.13.0","eol":null,"hubHref":"/vendor/tibco_software_inc/tibco_activematrix_businessworks_distribution_for_tibco_silver_fabric"},{"vendor":"tibco software inc.","product":"tibco activematrix businessworks for z/linux","name":"TIBCO ActiveMatrix BusinessWorks for z/Linux","label":"tibco activematrix businessworks for z/linux","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ 5.13.0","eol":null,"hubHref":"/vendor/tibco_software_inc/tibco_activematrix_businessworks_for_zlinux"},{"vendor":"tibco","product":"activematrix_businessworks","name":"activematrix businessworks","label":"activematrix_businessworks","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.13.0","eol":null,"hubHref":"/vendor/tibco/activematrix_businessworks"},{"vendor":"tibco","product":"activematrix_businessworks_distribution_for_tibco_silver_fabric","name":"activematrix businessworks distribution for tibco silver fabric","label":"activematrix_businessworks_distribution_for_tibco_silver_fabric","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.13.0","eol":null,"hubHref":"/vendor/tibco/activematrix_businessworks_distribution_for_tibco_silver_fabric"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.tibco.com/support/advisories/2018/08/tibco-security-advisory-august-7-2018-tibco-activematrix-businessworks","label":"www.tibco.com/support/…","hostname":"www.tibco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.tibco.com/services/support/advisories","label":"www.tibco.com/services/support/advisories","hostname":"www.tibco.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/105043","label":"www.securityfocus.com/bid/105043","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-08-08T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-17T02:56:30.441Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:12:46.236Z","stale":false,"partial":false}}