How severe is CVE-2019-11208?

CVE-2019-11208 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-11208 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-11208?

CVE-2019-11208 primarily affects Tibco Api Exchange Gateway. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-11208?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2019-11208 published?

CVE-2019-11208 was published on 2019-08-08 and last updated on 2026-06-17.

CVE-2019-11208

CVE-2019-11208 is a critical-severity vulnerability in Tibco Api Exchange Gateway with a CVSS 3.x base score of 9.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.9)
CVSS v2: 6.5
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Tibco Api Exchange Gateway
Published: 2019-08-08
Last modified: 2026-06-17

Description

The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.

Frequently asked questions

What is CVE-2019-11208?: The authorization component of TIBCO Software Inc.'s TIBCO API Exchange Gateway, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically processes OAuth authorization incorrectly, leading to potential escalation of privileges for the specific customer endpoint, when the implementation uses multiple scopes. This issue affects: TIBCO Software Inc.'s TIBCO API Exchange Gateway version 2.3.1 and prior versions, and TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric version 2.3.1 and prior versions.
How severe is CVE-2019-11208?: CVE-2019-11208 has a CVSS 3.x base score of 9.9, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-11208 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-11208?: CVE-2019-11208 primarily affects Tibco Api Exchange Gateway. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-11208?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2019-11208 published?: CVE-2019-11208 was published on 2019-08-08 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:*:*:*
cpe:2.3:a:tibco:api_exchange_gateway:*:*:*:*:*:silver_fabric:*:*

More vulnerabilities in Tibco Api Exchange Gateway

CVE-2021-23274 — Critical (CVSS 9.8): The Config UI component of TIBCO Software Inc.'s TIBCO API Exchange Gateway and TIBCO API Exchange Gateway Distribution…

All CVEs affecting Tibco Api Exchange Gateway →