{"schemaVersion":3,"id":"CVE-2020-9414","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.","dates":{"published":"2020-06-30T19:40:14.588Z","modified":"2024-09-17T01:41:47.701Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9,"severity":"high","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01691,"percentile":0.7676,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01691},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01691,"percentile":0.7676}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01691,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01691,"percentile":0.7676}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"tibco software inc.","product":"tibco managed file transfer command center","name":"TIBCO Managed File Transfer Command Center","label":"tibco managed file transfer command center","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ 8.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ 8.2.1","eol":null,"hubHref":"/vendor/tibco_software_inc/tibco_managed_file_transfer_command_center"},{"vendor":"tibco software inc.","product":"tibco managed file transfer internet server","name":"TIBCO Managed File Transfer Internet Server","label":"tibco managed file transfer internet server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, ≤ 8.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, ≤ 8.2.1","eol":null,"hubHref":"/vendor/tibco_software_inc/tibco_managed_file_transfer_internet_server"},{"vendor":"tibco","product":"managed_file_transfer_command_center","name":"managed file transfer command center","label":"managed_file_transfer_command_center","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.1","eol":null,"hubHref":"/vendor/tibco/managed_file_transfer_command_center"},{"vendor":"tibco","product":"managed_file_transfer_internet_server","name":"managed file transfer internet server","label":"managed_file_transfer_internet_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 8.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.1","eol":null,"hubHref":"/vendor/tibco/managed_file_transfer_internet_server"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.tibco.com/services/support/advisories","label":"www.tibco.com/services/support/advisories","hostname":"www.tibco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-06-30T19:40:14.588Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-17T01:41:47.701Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T22:48:53.332Z","stale":false,"partial":false}}