CVE-2020-9414 json
TIBCO Managed File Transfer reflected XSS vulerability
published 2020-06-30 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-30234
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
Patch / fix
- tibco managed_file_transfer_command_center 8.2.1
- tibco managed_file_transfer_internet_server 8.2.1
Exploit prediction
1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- TIBCO Software Inc. TIBCO Managed File Transfer Command Center
- TIBCO Software Inc. TIBCO Managed File Transfer Internet Server
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
tibco.com
/services/support/advisories
vendor-advisory
Sources
- CVE List CVE-2020-9414
- NVD CVE-2020-9414
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.