CVE-2018-12414

published 2018-11-06

CVE-2018-12414: The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous…

Priority P3 39 high 8.8 CVSS 3.0

AV N AC L PR N UI R S U C H I H A H

The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache), and Rendezvous Daemon Manager (rvdm) components of TIBCO Software Inc.'s TIBCO Rendezvous, TIBCO Rendezvous Developer Edition, TIBCO Rendezvous for z/Linux, TIBCO Rendezvous for z/OS, TIBCO Rendezvous Network Server, TIBCO Substation ES contain vulnerabilities which may allow an attacker to perform cross-site request forgery (CSRF) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Rendezvous: versions up to and including 8.4.5, TIBCO Rendezvous Developer Edition: versions up to and including 8.4.5, TIBCO Rendezvous for z/Linux: versions up to and including 8.4.5, TIBCO Rendezvous for z/OS: versions up to and including 8.4.5, TIBCO Rendezvous Network Server: versions up to and including 1.1.2, and TIBCO Substation ES: versions up to and including 2.12.2.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
tibco	rendezvous	<= 8.4.5	—
tibco	rendezvous_for_z_linux	<= 8.4.5	—
tibco	rendezvous_for_z_os	<= 8.4.5	—
tibco	rendezvous_network_server	<= 1.1.2	—
tibco	substation_es	<= 2.12.0	—
tibco_software_inc	tibco_rendezvous	unspecified – 8.4.5	—
tibco_software_inc	tibco_rendezvous_developer_edition	unspecified – 8.4.5	—
tibco_software_inc	tibco_rendezvous_for_z_linux	unspecified – 8.4.5	—
tibco_software_inc	tibco_rendezvous_for_z_os	unspecified – 8.4.5	—
tibco_software_inc	tibco_rendezvous_network_server	unspecified – 1.1.2	—
tibco_software_inc	tibco_substation_es	unspecified – 2.12.2	—

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 6.8 MEDIUM AV:N/AC:M/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352