Search criteria
84 vulnerabilities found for spotfire_server by tibco
FKIE_CVE-2023-26221
Vulnerability from fkie_nvd - Published: 2023-11-08 20:15 - Updated: 2024-11-21 07:50
Severity ?
5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
3.9 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
3.9 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Summary
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.
References
| URL | Tags | ||
|---|---|---|---|
| security@tibco.com | https://www.tibco.com/services/support/advisories | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tibco.com/services/support/advisories | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analyst | 12.3.0 | |
| tibco | spotfire_analyst | 12.4.0 | |
| tibco | spotfire_analyst | 12.5.0 | |
| tibco | spotfire_analytics_platform | 12.5.0 | |
| tibco | spotfire_server | 12.3.0 | |
| tibco | spotfire_server | 12.4.0 | |
| tibco | spotfire_server | 12.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "949054A7-A299-4C11-9E2B-7437D6C4D801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C63E85E6-8519-4957-B55B-0B8F6E658B2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FE433F55-79E4-438C-81C7-4CEEAEE1C442",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:12.5.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "55B9367D-3938-4059-BABE-72322C2AE10C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F7F5C30-950E-4483-8795-761C506BB549",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4B67F529-EB21-4628-ADA2-56E76DA272EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "889EE133-0CEE-429F-A58E-1F310FB981B8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire Connectors component of TIBCO Software Inc.\u0027s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.\n\n"
},
{
"lang": "es",
"value": "El componente Spotfire Connectors de Spotfire Analyst, Spotfire Server y Spotfire para AWS Marketplace de TIBCO Software Inc. contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante con pocos privilegios y acceso de lectura/escritura crear archivos maliciosos de Analyst. Un ataque exitoso que utilice esta vulnerabilidad requiere la interacci\u00f3n humana de una persona distinta del atacante. Las versiones afectadas son Spotfire Analyst de TIBCO Software Inc.: versiones 12.3.0, 12.4.0 y 12.5.0, Spotfire Server: versiones 12.3.0, 12.4.0 y 12.5.0, y Spotfire para AWS Marketplace: versi\u00f3n 12.5.0."
}
],
"id": "CVE-2023-26221",
"lastModified": "2024-11-21T07:50:56.717",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 2.7,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.3,
"impactScore": 2.5,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-08T20:15:07.313",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "security@tibco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2023-26220
Vulnerability from fkie_nvd - Published: 2023-10-10 23:15 - Updated: 2024-11-21 07:50
Severity ?
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.
References
| URL | Tags | ||
|---|---|---|---|
| security@tibco.com | https://www.tibco.com/services/support/advisories | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.tibco.com/services/support/advisories | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analyst | * | |
| tibco | spotfire_analyst | 11.5.0 | |
| tibco | spotfire_analyst | 11.6.0 | |
| tibco | spotfire_analyst | 11.7.0 | |
| tibco | spotfire_analyst | 11.8.0 | |
| tibco | spotfire_analyst | 12.0.0 | |
| tibco | spotfire_analyst | 12.0.1 | |
| tibco | spotfire_analyst | 12.0.2 | |
| tibco | spotfire_analyst | 12.0.3 | |
| tibco | spotfire_analyst | 12.0.4 | |
| tibco | spotfire_analyst | 12.1.0 | |
| tibco | spotfire_analyst | 12.1.1 | |
| tibco | spotfire_server | * | |
| tibco | spotfire_server | 11.5.0 | |
| tibco | spotfire_server | 11.6.0 | |
| tibco | spotfire_server | 11.6.1 | |
| tibco | spotfire_server | 11.6.2 | |
| tibco | spotfire_server | 11.6.3 | |
| tibco | spotfire_server | 11.7.0 | |
| tibco | spotfire_server | 11.8.0 | |
| tibco | spotfire_server | 11.8.1 | |
| tibco | spotfire_server | 12.0.0 | |
| tibco | spotfire_server | 12.0.1 | |
| tibco | spotfire_server | 12.0.2 | |
| tibco | spotfire_server | 12.0.3 | |
| tibco | spotfire_server | 12.0.4 | |
| tibco | spotfire_server | 12.0.5 | |
| tibco | spotfire_server | 12.1.0 | |
| tibco | spotfire_server | 12.1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*",
"matchCriteriaId": "841BE5EF-AA80-4864-8379-572F84D01CB1",
"versionEndIncluding": "11.4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6643BEFC-4C34-4D82-9451-79F2E2727230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98448711-785E-483A-BC6A-5A5311C7FF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7CB9F167-A6FF-46ED-9BCB-F4634ACB18B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E3122E8-7D53-4FE6-A38F-39ED821BC8BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12F5049F-F75D-45A3-A6A3-E22353721532",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F029AC1D-CB5B-4F2B-B255-EB98F7758232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2AD66F3D-4B7D-4C0A-A3DE-69C4A0D2B480",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F07C385A-55C6-4B35-9D1A-058958571530",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CF7CAF-77B3-4FB8-AD50-E74999A5306E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0D671E2F-D211-4E0D-B351-92A08327E439",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD0A72BA-11DB-494E-9FBA-415253D878BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4A54F9B1-432F-4BDF-8331-710EB7DC7DA0",
"versionEndIncluding": "11.4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "50269188-015E-406A-90B8-5F113773A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBDD97C0-212A-4E53-9246-65ED746C6554",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7E22936E-ADBE-4D1F-AB3E-574DDE9B26E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "71EF8AB2-09E0-4235-B7A2-41867303ACA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2838D095-0DA8-4F1B-BAD4-D5A326C5D65C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "014E0C2D-6601-478E-A5EF-D14789430A31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5854EC01-743F-4B31-B51F-34DE3F4DDCFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "113FBC40-777B-4B99-A5BF-A40F6707AFD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "117AF754-4972-4254-A158-37B87C054DAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7619EE98-BAFF-4685-B434-4CD2966D6C2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7487265D-177D-40E5-8BBA-54224B9FFC96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C7722AC4-9856-403E-92A9-5CD0CFA57CDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4A18039B-1EF0-4617-9579-509E611FA859",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2FB4CDB7-3FA6-4441-94F6-CEA13BD8C811",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DE8D46B2-D8C9-4FF9-A6FA-61B755241B12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8466B949-D760-46C3-BC9B-11489DA9773F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire Library component of TIBCO Software Inc.\u0027s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.\n\n"
},
{
"lang": "es",
"value": "El componente Spotfire Library de Spotfire Analyst y Spotfire Server de TIBCO Software Inc. contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante con pocos privilegios y acceso a la red ejecutar Cross Site Scripting (XSS) almacenado en el sistema afectado. Un ataque exitoso que utilice esta vulnerabilidad requiere la interacci\u00f3n humana de una persona distinta del atacante. Las versiones afectadas son Spotfire Analyst de TIBCO Software Inc.: versiones 11.4.7 e inferiores, versiones 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0. 3 y 12.0.4, versiones 12.1.0 y 12.1.1 y Spotfire Server: versiones 11.4.11 y anteriores, versiones 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0 , 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4 y 12.0.5, versiones 12.1.0 y 12.1.1."
}
],
"id": "CVE-2023-26220",
"lastModified": "2024-11-21T07:50:56.580",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-10T23:15:09.933",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security@tibco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-41558
Vulnerability from fkie_nvd - Published: 2022-11-15 19:15 - Updated: 2025-04-29 21:15
Severity ?
9.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analyst | * | |
| tibco | spotfire_analyst | 11.5.0 | |
| tibco | spotfire_analyst | 11.6.0 | |
| tibco | spotfire_analyst | 11.7.0 | |
| tibco | spotfire_analyst | 11.8.0 | |
| tibco | spotfire_analyst | 12.0.0 | |
| tibco | spotfire_analyst | 12.0.1 | |
| tibco | spotfire_analyst | 12.1.0 | |
| tibco | spotfire_analytics_platform | * | |
| tibco | spotfire_desktop | * | |
| tibco | spotfire_desktop | 11.5.0 | |
| tibco | spotfire_desktop | 11.6.0 | |
| tibco | spotfire_desktop | 11.7.0 | |
| tibco | spotfire_desktop | 11.8.0 | |
| tibco | spotfire_desktop | 12.0.0 | |
| tibco | spotfire_desktop | 12.0.1 | |
| tibco | spotfire_desktop | 12.1.0 | |
| tibco | spotfire_server | * | |
| tibco | spotfire_server | 11.5.0 | |
| tibco | spotfire_server | 11.6.0 | |
| tibco | spotfire_server | 11.6.1 | |
| tibco | spotfire_server | 11.6.2 | |
| tibco | spotfire_server | 11.6.3 | |
| tibco | spotfire_server | 11.7.0 | |
| tibco | spotfire_server | 11.8.0 | |
| tibco | spotfire_server | 11.8.1 | |
| tibco | spotfire_server | 12.0.0 | |
| tibco | spotfire_server | 12.0.1 | |
| tibco | spotfire_server | 12.1.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*",
"matchCriteriaId": "37C458AE-DF6D-4A9D-8954-9F9A746EA153",
"versionEndIncluding": "11.4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6643BEFC-4C34-4D82-9451-79F2E2727230",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "98448711-785E-483A-BC6A-5A5311C7FF63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7CB9F167-A6FF-46ED-9BCB-F4634ACB18B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7E3122E8-7D53-4FE6-A38F-39ED821BC8BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12F5049F-F75D-45A3-A6A3-E22353721532",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F029AC1D-CB5B-4F2B-B255-EB98F7758232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0D671E2F-D211-4E0D-B351-92A08327E439",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:*:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "97136A36-0254-4B1A-8132-349EB8279258",
"versionEndIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6A05C189-5144-4A7B-8EB4-587E4D9154FE",
"versionEndIncluding": "11.4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A0D2B72E-FD8D-4B3D-8DE7-BE80FCD36F91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FE7FF297-7538-4692-9870-8715F9D22BFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DF1D2B69-5F93-48F2-8928-AD74354C488C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "45724495-A8C3-45FA-988D-AB43174C1C2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FC2BEA33-539C-455A-9199-F39B101CA25E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:12.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "019F4B98-5C77-4EC3-830B-DF29D7E0B833",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:12.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "14BB5140-FC8B-4C2B-A69D-F7BF5A2E7392",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B00BABD-914D-4653-8607-E0EB4D9FE251",
"versionEndIncluding": "11.4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "50269188-015E-406A-90B8-5F113773A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBDD97C0-212A-4E53-9246-65ED746C6554",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7E22936E-ADBE-4D1F-AB3E-574DDE9B26E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "71EF8AB2-09E0-4235-B7A2-41867303ACA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2838D095-0DA8-4F1B-BAD4-D5A326C5D65C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "014E0C2D-6601-478E-A5EF-D14789430A31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5854EC01-743F-4B31-B51F-34DE3F4DDCFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "113FBC40-777B-4B99-A5BF-A40F6707AFD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "117AF754-4972-4254-A158-37B87C054DAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7619EE98-BAFF-4685-B434-4CD2966D6C2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DE8D46B2-D8C9-4FF9-A6FA-61B755241B12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Visualizations component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0."
},
{
"lang": "es",
"value": "El componente de visualizaciones de TIBCO Spotfire Analyst de TIBCO Software Inc., TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform para AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, y TIBCO Spotfire Server contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante con pocos privilegios y acceso a la red ejecutar Cross Site Scripting (XSS) Almacenado en el sistema afectado. Un ataque exitoso que utilice esta vulnerabilidad requiere la interacci\u00f3n humana de una persona distinta del atacante. Las versiones afectadas son:\nTIBCO Spotfire Analyst de TIBCO Software Inc.: versiones 11.4.4 e inferiores, \nTIBCO Spotfire Analyst: versiones 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0 y 12.0.1. \nTIBCO Spotfire Analyst: versi\u00f3n 12.1.0, \nTIBCO Spotfire Analytics Platform para AWS Marketplace: versiones 12.1.0 y anteriores, \nTIBCO Spotfire Desktop: versiones 11.4.4 y anteriores, \nTIBCO Spotfire Desktop: versiones 11.5.0, 11.6.0, 11.7. 0, 11.8.0, 12.0.0 y 12.0.1, \nTIBCO Spotfire Desktop: versi\u00f3n 12.1.0, \nTIBCO Spotfire Server: versiones 11.4.8 y anteriores, \nTIBCO Spotfire Server: versiones 11.5.0, 11.6.0, 11.6. 1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0 y 12.0.1, \ny TIBCO Spotfire Server: versi\u00f3n 12.1.0."
}
],
"id": "CVE-2022-41558",
"lastModified": "2025-04-29T21:15:48.637",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 6.0,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-15T19:15:36.153",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2022-30579
Vulnerability from fkie_nvd - Published: 2022-09-20 19:15 - Updated: 2025-05-28 16:15
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L
8.4 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
8.4 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Summary
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analytics_platform | 12.0.0 | |
| tibco | spotfire_server | 12.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:12.0.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "D72F7491-3285-4EC5-9CAB-E5A8EF516861",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:12.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "117AF754-4972-4254-A158-37B87C054DAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0."
},
{
"lang": "es",
"value": "El componente Web Player de TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace y TIBCO Spotfire Server contiene una vulnerabilidad dif\u00edcil de explotar que permite a un atacante poco privilegiado y acceso a la red ejecutar un ataque de tipo Server Side Request Forgery (SSRF) ciego en el sistema afectado. Las versiones afectadas son TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versi\u00f3n 12.0.0 y TIBCO Spotfire Server: versi\u00f3n 12.0.0"
}
],
"id": "CVE-2022-30579",
"lastModified": "2025-05-28T16:15:23.310",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.3,
"impactScore": 5.3,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-09-20T19:15:09.863",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
FKIE_CVE-2021-43051
Vulnerability from fkie_nvd - Published: 2021-12-14 20:15 - Updated: 2024-11-21 06:28
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Summary
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_server | * | |
| tibco | spotfire_server | 11.0.0 | |
| tibco | spotfire_server | 11.1.0 | |
| tibco | spotfire_server | 11.2.0 | |
| tibco | spotfire_server | 11.3.0 | |
| tibco | spotfire_server | 11.4.0 | |
| tibco | spotfire_server | 11.4.1 | |
| tibco | spotfire_server | 11.5.0 | |
| tibco | spotfire_server | 11.6.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "65F48E15-4E1E-4CD0-A737-1D6818E81071",
"versionEndIncluding": "10.10.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58D5C32A-F10F-4237-99BB-163B4B7D6D1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B68BAB9A-2479-4C36-B12A-D9F5A6C98D0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA8E5F64-CCF2-41D5-B93A-1A0BB5248F02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9262AA9-DFE0-4D68-AF0A-257C8B4AB307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D52525B5-0D8D-4C1A-81A5-0D22AF28D8C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DB76DC2-D561-42F4-8272-3B342F75EBE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "50269188-015E-406A-90B8-5F113773A3D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EBDD97C0-212A-4E53-9246-65ED746C6554",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0."
},
{
"lang": "es",
"value": "El componente Spotfire Server de TIBCO Software Inc. contiene una vulnerabilidad dif\u00edcil de explotar que permite a clientes maliciosos de la API personalizada con acceso a la red ejecutar operaciones internas de la API fuera del alcance de las concedidas. Un ataque con \u00e9xito usando esta vulnerabilidad requiere la interacci\u00f3n humana de una persona distinta al atacante. Las versiones afectadas son TIBCO Spotfire Server de TIBCO Software Inc.: versiones 10.10.6 y anteriores, TIBCO Spotfire Server: versiones 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0 y 11.4.1, y TIBCO Spotfire Server: versiones 11.5.0 y 11.6.0"
}
],
"id": "CVE-2021-43051",
"lastModified": "2024-11-21T06:28:36.027",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-12-14T20:15:07.553",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23275
Vulnerability from fkie_nvd - Published: 2021-06-29 18:15 - Updated: 2024-11-21 05:51
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:*:*:*:*:server:*:*:*",
"matchCriteriaId": "9F251C4F-DC9E-45B1-822B-77ABE937F970",
"versionEndIncluding": "1.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.0:*:*:*:server:*:*:*",
"matchCriteriaId": "5B1E8362-7D8C-4D8C-A337-1A994BB96D92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.1:*:*:*:server:*:*:*",
"matchCriteriaId": "0C5E2114-4947-4954-BECC-344ED3C77994",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.4.0:*:*:*:server:*:*:*",
"matchCriteriaId": "436848E8-42D4-428C-B979-A817861E17EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.5.0:*:*:*:server:*:*:*",
"matchCriteriaId": "6C7A1A92-99DB-4665-8C50-33819B222091",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.6.0:*:*:*:server:*:*:*",
"matchCriteriaId": "375D0027-44E3-4144-B48D-72813C2CD850",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:*:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "73352CBA-FB37-4B50-8F61-584CEA5358E7",
"versionEndIncluding": "11.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C363AFD7-F7EC-4F06-AEB0-10B94A8EC513",
"versionEndIncluding": "10.3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12B0BE70-96A5-40BA-B990-5C831EB2B043",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2886371B-CDE7-4352-8F94-5455A6C0B59B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5413400F-1A04-4340-B75A-9BFE1BD3FEC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3A586E5-91CB-4167-99A0-17D692AF02ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28151CD2-540D-4D16-A894-082C2946FEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "901B6B29-8644-43BC-BFAD-3229CD37FB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1490724A-AF67-4037-B5D9-47477B58D765",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A962BD2-0CB0-4EE5-9904-362FDB9655D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA54B6E-D53B-4196-AAD4-1C551C635D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "047CA6DF-7CF2-4B6F-BDFD-DB1EC64D6C1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8F5F724C-30A5-4BA3-9047-3B0DFE30B4BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AA297F15-2B70-4A13-9D63-816FD3149A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "725C73FF-99C6-4724-AF0F-BD71C3879C66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58D5C32A-F10F-4237-99BB-163B4B7D6D1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B68BAB9A-2479-4C36-B12A-D9F5A6C98D0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA8E5F64-CCF2-41D5-B93A-1A0BB5248F02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9262AA9-DFE0-4D68-AF0A-257C8B4AB307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4098AC3A-EDEB-45F9-A791-0563F56B3F2D",
"versionEndIncluding": "10.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D9033F95-BBB4-4668-9E39-8F19301C5095",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2D0DACE2-8873-4C00-9715-22CAE085E353",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2FAE559B-5184-416E-9646-537BC616E8E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1CC49A-4495-40AC-A426-78D5DE841713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0D37D1F9-095F-419C-85CD-663092A20940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "137284BF-BFA8-4F33-9E17-710882639F32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
},
{
"lang": "es",
"value": "El componente de instalaci\u00f3n en Windows de TIBCO Software Inc. \u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, y TIBCO Spotfire Statistics Services contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante poco privilegiado y con acceso local en algunas versiones del sistema operativo Windows insertar software malicioso. El componente afectado puede ser abusado para ejecutar el software malicioso insertado por el atacante con los privilegios elevados del componente. Esta vulnerabilidad es debido a una falta de restricciones de acceso a determinados archivos y/o carpetas de la instalaci\u00f3n. Las versiones afectadas son TIBCO Enterprise Runtime for R - Server Edition de TIBCO Software Inc.: versiones 1.2.4 y posteriores, TIBCO Enterprise Runtime for R - Server Edition: versiones 1.3.0 y 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versiones 1.4.0, 1.5.0 y 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versiones 11.3.0 y posteriores, TIBCO Spotfire Server: versiones 10.3. 12 y por debajo TIBCO Spotfire Server: versiones 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3 y 10.10.4, TIBCO Spotfire Server: versiones 11.0.0, 11.1.0, 11.2.0 y 11. 3.0, TIBCO Spotfire Statistics Services: versiones 10.3.0 y posteriores, TIBCO Spotfire Statistics Services: versiones 10.10.0, 10.10.1 y 10.10.2, y TIBCO Spotfire Statistics Services: versiones 11.1.0, 11.2.0 y 11.3.0"
}
],
"id": "CVE-2021-23275",
"lastModified": "2024-11-21T05:51:28.923",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-29T18:15:08.567",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-28830
Vulnerability from fkie_nvd - Published: 2021-06-29 18:15 - Updated: 2024-11-21 06:00
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:*:*:*:*:server:*:*:*",
"matchCriteriaId": "9F251C4F-DC9E-45B1-822B-77ABE937F970",
"versionEndIncluding": "1.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.0:*:*:*:server:*:*:*",
"matchCriteriaId": "5B1E8362-7D8C-4D8C-A337-1A994BB96D92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.1:*:*:*:server:*:*:*",
"matchCriteriaId": "0C5E2114-4947-4954-BECC-344ED3C77994",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.4.0:*:*:*:server:*:*:*",
"matchCriteriaId": "436848E8-42D4-428C-B979-A817861E17EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.5.0:*:*:*:server:*:*:*",
"matchCriteriaId": "6C7A1A92-99DB-4665-8C50-33819B222091",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:enterprise_runtime_for_r:1.6.0:*:*:*:server:*:*:*",
"matchCriteriaId": "375D0027-44E3-4144-B48D-72813C2CD850",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:*:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "73352CBA-FB37-4B50-8F61-584CEA5358E7",
"versionEndIncluding": "11.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C363AFD7-F7EC-4F06-AEB0-10B94A8EC513",
"versionEndIncluding": "10.3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12B0BE70-96A5-40BA-B990-5C831EB2B043",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2886371B-CDE7-4352-8F94-5455A6C0B59B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5413400F-1A04-4340-B75A-9BFE1BD3FEC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3A586E5-91CB-4167-99A0-17D692AF02ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28151CD2-540D-4D16-A894-082C2946FEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "901B6B29-8644-43BC-BFAD-3229CD37FB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1490724A-AF67-4037-B5D9-47477B58D765",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A962BD2-0CB0-4EE5-9904-362FDB9655D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA54B6E-D53B-4196-AAD4-1C551C635D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "047CA6DF-7CF2-4B6F-BDFD-DB1EC64D6C1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8F5F724C-30A5-4BA3-9047-3B0DFE30B4BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AA297F15-2B70-4A13-9D63-816FD3149A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "725C73FF-99C6-4724-AF0F-BD71C3879C66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58D5C32A-F10F-4237-99BB-163B4B7D6D1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B68BAB9A-2479-4C36-B12A-D9F5A6C98D0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA8E5F64-CCF2-41D5-B93A-1A0BB5248F02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F9262AA9-DFE0-4D68-AF0A-257C8B4AB307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4098AC3A-EDEB-45F9-A791-0563F56B3F2D",
"versionEndIncluding": "10.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D9033F95-BBB4-4668-9E39-8F19301C5095",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2D0DACE2-8873-4C00-9715-22CAE085E353",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2FAE559B-5184-416E-9646-537BC616E8E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "BA1CC49A-4495-40AC-A426-78D5DE841713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0D37D1F9-095F-419C-85CD-663092A20940",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "137284BF-BFA8-4F33-9E17-710882639F32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
},
{
"lang": "es",
"value": "Los componentes TIBCO Spotfire Server y TIBCO Enterprise Runtime for R de TIBCO Software Inc. \u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, y TIBCO Spotfire Statistics Services contienen una vulnerabilidad que te\u00f3ricamente permite a un atacante poco privileagiado y con acceso local en el sistema operativo Windows insertar software malicioso. El componente afectado puede ser abusado para ejecutar el software malicioso insertado por el atacante con los privilegios elevados del componente. Esta vulnerabilidad resulta de la b\u00fasqueda de artefactos en tiempo de ejecuci\u00f3n por parte del componente afectado fuera de la jerarqu\u00eda de instalaci\u00f3n. Las versiones afectadas son TIBCO Enterprise Runtime for R - Server Edition de TIBCO Software Inc.: versiones 1.2.4 y posteriores, TIBCO Enterprise Runtime for R - Server Edition: versiones 1.3.0 y 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versiones 1.4.0, 1.5.0 y 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versiones 11.3.0 y posteriores, TIBCO Spotfire Server: versiones 10.3. 12 e inferiores, TIBCO Spotfire Server: versiones 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3 y 10.10.4, TIBCO Spotfire Server: versiones 11.0.0, 11.1.0, 11.2.0 y 11. 3.0, TIBCO Spotfire Statistics Services: versiones 10.3.0 e inferiores, TIBCO Spotfire Statistics Services: versiones 10.10.0, 10.10.1 y 10.10.2, y TIBCO Spotfire Statistics Services: versiones 11.1.0, 11.2.0 y 11.3.0"
}
],
"id": "CVE-2021-28830",
"lastModified": "2024-11-21T06:00:17.227",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-29T18:15:08.607",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-23273
Vulnerability from fkie_nvd - Published: 2021-03-09 21:15 - Updated: 2024-11-21 05:51
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | analytics_platform | * | |
| tibco | spotfire_analyst | * | |
| tibco | spotfire_analyst | 10.7.0 | |
| tibco | spotfire_analyst | 10.8.0 | |
| tibco | spotfire_analyst | 10.9.0 | |
| tibco | spotfire_analyst | 10.10.0 | |
| tibco | spotfire_analyst | 10.10.1 | |
| tibco | spotfire_analyst | 10.10.2 | |
| tibco | spotfire_analyst | 11.0.0 | |
| tibco | spotfire_analyst | 11.1.0 | |
| tibco | spotfire_desktop | * | |
| tibco | spotfire_desktop | 10.7.0 | |
| tibco | spotfire_desktop | 10.8.0 | |
| tibco | spotfire_desktop | 10.9.0 | |
| tibco | spotfire_desktop | 10.10.0 | |
| tibco | spotfire_desktop | 10.10.1 | |
| tibco | spotfire_desktop | 10.10.2 | |
| tibco | spotfire_desktop | 11.0.0 | |
| tibco | spotfire_desktop | 11.1.0 | |
| tibco | spotfire_server | * | |
| tibco | spotfire_server | 10.7.0 | |
| tibco | spotfire_server | 10.8.0 | |
| tibco | spotfire_server | 10.8.1 | |
| tibco | spotfire_server | 10.9.0 | |
| tibco | spotfire_server | 10.10.0 | |
| tibco | spotfire_server | 10.10.1 | |
| tibco | spotfire_server | 10.10.2 | |
| tibco | spotfire_server | 10.10.3 | |
| tibco | spotfire_server | 11.0.0 | |
| tibco | spotfire_server | 11.1.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:analytics_platform:*:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "5AEB1299-AD20-4B5A-AD92-E2BD4AB0BD61",
"versionEndIncluding": "11.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4EECB41F-9602-41C6-89AD-3567CCE6CD84",
"versionEndIncluding": "10.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "529B7D1D-3734-433F-87FF-EED082378421",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3F102050-55D2-4DCC-AEA2-7EEF4042B23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7EC965E0-2B80-420F-AE1D-F68B4DB6C314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2802ABF7-E503-4FBF-A8C1-D78DC167FB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CCE461AE-B840-41A1-BD45-75408316EFA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD5FEF12-1AF5-43FB-96CF-074FED42BDA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43B50563-341C-498B-85DB-A564DC4787EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16029A99-9B9C-4006-8314-67C8731BDCE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:*:*:*:*:*:*:*:*",
"matchCriteriaId": "71D20203-4F5A-48AE-A3C9-517B94A9F596",
"versionEndIncluding": "10.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77D5AFBD-DD57-4744-BB81-0ABBDBDE0171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D3DEF011-D075-44CE-8D5B-E85562360E4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D25CEF2-A066-44B0-AE48-26C39A0A7507",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4399AF82-5A89-4DC0-866B-B70D21CE5C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "82E01304-336B-4E87-8122-570DE139E06E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68ED0B9D-699F-476A-AEFD-2CE5B8CA1C89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A9F866EB-F423-4491-951D-AF0A6681683A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "04347EE2-37C4-44EC-A533-9518E793C15F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3C2F12D0-C533-49FA-84D8-3333DDD097A4",
"versionEndIncluding": "10.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28151CD2-540D-4D16-A894-082C2946FEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "901B6B29-8644-43BC-BFAD-3229CD37FB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1490724A-AF67-4037-B5D9-47477B58D765",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A962BD2-0CB0-4EE5-9904-362FDB9655D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA54B6E-D53B-4196-AAD4-1C551C635D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "047CA6DF-7CF2-4B6F-BDFD-DB1EC64D6C1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8F5F724C-30A5-4BA3-9047-3B0DFE30B4BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "AA297F15-2B70-4A13-9D63-816FD3149A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "58D5C32A-F10F-4237-99BB-163B4B7D6D1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B68BAB9A-2479-4C36-B12A-D9F5A6C98D0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0."
},
{
"lang": "es",
"value": "El componente del cliente Spotfire de TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform para AWS Marketplace, TIBCO Spotfire Desktop y TIBCO Spotfire Server, de TIBCO Software Inc, contiene una vulnerabilidad que te\u00f3ricamente permite a un atacante con pocos privilegios y acceso a la red ejecutar un ataque de tipo Cross Site Scripting (XSS) almacenado en el sistema afectado.\u0026#xa0;Un ataque exitoso que utilice esta vulnerabilidad requiere la interacci\u00f3n humana de una persona que no sea el atacante.\u0026#xa0;Las versiones afectadas son TIBCO Spotfire Analyst de TIBCO Software Inc.: versiones 10.3.3 y anteriores, versiones 10.10.0, 10.10.1 y 10.10.2, versiones 10.7.0, 10.8.0, 10.9.0, 11.0.0 y 11.1.0, TIBCO Spotfire Analytics Platform para AWS Marketplace: versiones 11.1.0 y anteriores, TIBCO Spotfire Desktop: versiones 10.3.3 y anteriores, versiones 10.10.0, 10.10.1 y 10.10.2, versiones 10.7.0 , 10.8.0, 10.9.0, 11.0.0 y 11.1.0, y TIBCO Spotfire Server: versiones 10.3.11 y anteriores, versiones 10.10.0, 10.10.1, 10.10.2 y 10.10.3, versiones 10.7 .0, 10.8.0, 10.8.1, 10.9.0, 11.0.0 y 11.1.0"
}
],
"id": "CVE-2021-23273",
"lastModified": "2024-11-21T05:51:28.673",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-03-09T21:15:14.640",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-9416
Vulnerability from fkie_nvd - Published: 2020-09-15 19:15 - Updated: 2024-11-21 05:40
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analyst | 10.7.0 | |
| tibco | spotfire_analyst | 10.8.0 | |
| tibco | spotfire_analyst | 10.9.0 | |
| tibco | spotfire_analyst | 10.10.0 | |
| tibco | spotfire_analytics_platform | 10.7.0 | |
| tibco | spotfire_analytics_platform | 10.8.0 | |
| tibco | spotfire_analytics_platform | 10.8.1 | |
| tibco | spotfire_analytics_platform | 10.9.0 | |
| tibco | spotfire_analytics_platform | 10.10.0 | |
| tibco | spotfire_analytics_platform | 10.10.1 | |
| tibco | spotfire_desktop | 10.7.0 | |
| tibco | spotfire_desktop | 10.8.0 | |
| tibco | spotfire_desktop | 10.9.0 | |
| tibco | spotfire_desktop | 10.10.0 | |
| tibco | spotfire_server | 10.7.0 | |
| tibco | spotfire_server | 10.8.0 | |
| tibco | spotfire_server | 10.8.1 | |
| tibco | spotfire_server | 10.9.0 | |
| tibco | spotfire_server | 10.10.0 | |
| tibco | spotfire_server | 10.10.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "529B7D1D-3734-433F-87FF-EED082378421",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3F102050-55D2-4DCC-AEA2-7EEF4042B23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7EC965E0-2B80-420F-AE1D-F68B4DB6C314",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analyst:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2802ABF7-E503-4FBF-A8C1-D78DC167FB5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.7.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "F3495FF5-8541-4E0B-915C-1642D40009F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.8.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "890B1AAF-3AFF-406C-858A-8B93F1513D5E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.8.1:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "EC56F0DD-46EF-44A2-8CBD-BE04784A4070",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.9.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "4B25A257-59C6-4A8C-ADFB-9812A99450AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.10.0:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "1AF24EBE-7A00-4BA3-ABCC-F1806FABFB97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform:10.10.1:*:*:*:*:aws_marketplace:*:*",
"matchCriteriaId": "5C45EC10-874A-44F1-BFB0-FC657BDDFDAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77D5AFBD-DD57-4744-BB81-0ABBDBDE0171",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D3DEF011-D075-44CE-8D5B-E85562360E4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8D25CEF2-A066-44B0-AE48-26C39A0A7507",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_desktop:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4399AF82-5A89-4DC0-866B-B70D21CE5C05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28151CD2-540D-4D16-A894-082C2946FEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "901B6B29-8644-43BC-BFAD-3229CD37FB9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1490724A-AF67-4037-B5D9-47477B58D765",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A962BD2-0CB0-4EE5-9904-362FDB9655D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA54B6E-D53B-4196-AAD4-1C551C635D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "047CA6DF-7CF2-4B6F-BDFD-DB1EC64D6C1E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1."
},
{
"lang": "es",
"value": "El componente cliente Spotfire de TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform para AWS Marketplace, TIBCO Spotfire Desktop y TIBCO Spotfire Server; de TIBCO Software Inc, contiene una vulnerabilidad que te\u00f3ricamente permite a un usuario leg\u00edtimo inyectar scripts.\u0026#xa0;Si los ejecuta una v\u00edctima autenticada en el sistema afectado, estos scripts ser\u00e1n ejecutados con los privilegios de la v\u00edctima.\u0026#xa0;Las versiones afectadas son TIBCO Spotfire Analyst: versiones 10.7.0, 10.8.0, 10.9.0 y 10.10.0, TIBCO Spotfire Analytics Platform para AWS Marketplace: versiones 10.7.0, 10.8.0, 10.8. 1, 10.9.0, 10.10.0 y 10.10.1, TIBCO Spotfire Desktop: versiones 10.7.0, 10.8.0, 10.9.0 y 10.10.0, y TIBCO Spotfire Server: versiones 10.7.0, 10.8.0 , 10.8.1, 10.9.0, 10.10.0 y 10.10.1; de TIBCO Software Inc"
}
],
"id": "CVE-2020-9416",
"lastModified": "2024-11-21T05:40:35.917",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 5.3,
"source": "security@tibco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-15T19:15:13.370",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2020-9408
Vulnerability from fkie_nvd - Published: 2020-03-11 20:15 - Updated: 2024-11-21 05:40
Severity ?
Summary
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tibco | spotfire_analytics_platform_for_aws | * | |
| tibco | spotfire_server | * | |
| tibco | spotfire_server | 7.12.0 | |
| tibco | spotfire_server | 7.13.0 | |
| tibco | spotfire_server | 7.14.0 | |
| tibco | spotfire_server | 10.0.0 | |
| tibco | spotfire_server | 10.0.1 | |
| tibco | spotfire_server | 10.1.0 | |
| tibco | spotfire_server | 10.2.0 | |
| tibco | spotfire_server | 10.3.0 | |
| tibco | spotfire_server | 10.3.1 | |
| tibco | spotfire_server | 10.3.2 | |
| tibco | spotfire_server | 10.3.3 | |
| tibco | spotfire_server | 10.3.4 | |
| tibco | spotfire_server | 10.3.5 | |
| tibco | spotfire_server | 10.3.6 | |
| tibco | spotfire_server | 10.4.0 | |
| tibco | spotfire_server | 10.5.0 | |
| tibco | spotfire_server | 10.6.0 | |
| tibco | spotfire_server | 10.6.1 | |
| tibco | spotfire_server | 10.7.0 | |
| tibco | spotfire_server | 10.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:*:*:*:*:*:*:*:*",
"matchCriteriaId": "03FDA07A-FF4F-4D5E-BC10-16049E3C8BC2",
"versionEndIncluding": "10.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28424400-3ADD-4719-A1FF-DD2BA3E78CB4",
"versionEndIncluding": "7.11.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:7.12.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0F59A46F-9E34-4354-AB7D-73A253014BA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:7.13.0:*:*:*:*:*:*:*",
"matchCriteriaId": "97B691A6-B273-4880-AD61-53169C4C3CEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:7.14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "47E57AE2-D98C-4231-9E56-A5EE8B5BC0AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "933FA68E-688B-40E6-A49B-952C3CC7123C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "55C0068C-761E-4B11-9FB3-D1F038B789D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5C854AEB-1870-4AC1-828C-BCDA9EC92956",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F5203DA4-7F5D-4221-9CC0-00FE30B6F388",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "121DE084-9E95-4768-872B-16B12DC421BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "11F3CAA3-510B-400B-927E-8BEBB6DEFC9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B75EF05E-A26B-4DAA-8550-80119A12149A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6C6CF19F-CD9D-4174-B6D0-EE65DACCF8EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "107D36D1-83C9-463E-B87D-B6CA67381EE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "50180763-F7D4-4CEB-9DED-EE6A8EDC8049",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "E6D8708F-F06E-42C1-8D11-7265A102B708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12B0BE70-96A5-40BA-B990-5C831EB2B043",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2886371B-CDE7-4352-8F94-5455A6C0B59B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5413400F-1A04-4340-B75A-9BFE1BD3FEC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C3A586E5-91CB-4167-99A0-17D692AF02ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28151CD2-540D-4D16-A894-082C2946FEF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "901B6B29-8644-43BC-BFAD-3229CD37FB9E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
},
{
"lang": "es",
"value": "El componente de biblioteca Spotfire de TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace y TIBCO Spotfire Server, contienen una vulnerabilidad que te\u00f3ricamente permite a un atacante con permisos de escritura en la Biblioteca Spotfire, pero sin el permiso de grupo \"Script Author\", modificar atributos de archivos y objetos guardados en la biblioteca de modo que el sistema los trate como seguros. Esto podr\u00eda permitir a un atacante causar que Spotfire Web Player, Analyst clients y TERR Service ejecuten c\u00f3digo arbitrario con los privilegios de la cuenta system que inici\u00f3 esos procesos. Las versiones afectadas son TIBCO Spotfire Analytics Platform for AWS Marketplace: versiones 10.8.0 y por debajo y TIBCO Spotfire Server: versiones 7.11.9 y por debajo, versiones 7.12.0, 7.13.0, 7.14.0, 10.0. 0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5 y 10.3.6, versiones 10.4.0, 10.5. 0, 10.6.0, 10.6.1, 10.7.0 y 10.8.0. Todas de TIBCO Software Inc."
}
],
"id": "CVE-2020-9408",
"lastModified": "2024-11-21T05:40:34.843",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.1,
"impactScore": 6.0,
"source": "security@tibco.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-11T20:15:13.210",
"references": [
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "security@tibco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
],
"sourceIdentifier": "security@tibco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-26221 (GCVE-0-2023-26221)
Vulnerability from cvelistv5 – Published: 2023-11-08 19:44 – Updated: 2024-09-04 15:46
VLAI?
Title
TIBCO Spotfire Insufficiently Protected Credential vulnerability
Summary
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.
Severity ?
5 (Medium)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | Spotfire Analyst |
Affected:
12.3.0
Affected: 12.4.0 Affected: 12.5.0 |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:46:23.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T15:46:35.719041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T15:46:47.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Spotfire Connectors component of TIBCO Software Inc.\u0027s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.\u003c/p\u003e"
}
],
"value": "The Spotfire Connectors component of TIBCO Software Inc.\u0027s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-08T19:44:03.634Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTIBCO has released updated versions of the affected components which address these issues.\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\u003c/p\u003e\u003cp\u003eSpotfire for AWS Marketplace version 12.5.0: update to version 14.0.0 or later\u003c/p\u003e"
}
],
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nSpotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\n\nSpotfire Server versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\n\nSpotfire for AWS Marketplace version 12.5.0: update to version 14.0.0 or later\n\n"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Insufficiently Protected Credential vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2023-26221",
"datePublished": "2023-11-08T19:44:03.634Z",
"dateReserved": "2023-02-20T22:18:23.428Z",
"dateUpdated": "2024-09-04T15:46:47.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26220 (GCVE-0-2023-26220)
Vulnerability from cvelistv5 – Published: 2023-10-10 22:06 – Updated: 2024-09-18 16:14
VLAI?
Title
TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability
Summary
The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | Spotfire Analyst |
Affected:
0 , ≤ 11.4.7
(semver)
Affected: 11.5.0 Affected: 11.6.0 Affected: 11.7.0 Affected: 11.8.0 Affected: 12.0.0 Affected: 12.0.1 Affected: 12.0.2 Affected: 12.0.3 Affected: 12.0.4 Affected: 12.1.0 Affected: 12.1.1 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:46:24.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26220",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:14:40.488828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:14:49.914Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
},
{
"status": "affected",
"version": "12.0.2"
},
{
"status": "affected",
"version": "12.0.3"
},
{
"status": "affected",
"version": "12.0.4"
},
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.6.1"
},
{
"status": "affected",
"version": "11.6.2"
},
{
"status": "affected",
"version": "11.6.3"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "11.8.1"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
},
{
"status": "affected",
"version": "12.0.2"
},
{
"status": "affected",
"version": "12.0.3"
},
{
"status": "affected",
"version": "12.0.4"
},
{
"status": "affected",
"version": "12.0.5"
},
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Spotfire Library component of TIBCO Software Inc.\u0027s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.\u003c/p\u003e"
}
],
"value": "The Spotfire Library component of TIBCO Software Inc.\u0027s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-10T22:06:36.002Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTIBCO has released updated versions of the affected components which address these issues.\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 11.4.7 and below: update to version 11.4.8 or later\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4: update to version 12.0.5 or later\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 11.4.11 and below: update to version 11.4.12 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5: update to version 12.0.6 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\u003c/p\u003e"
}
],
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nSpotfire Analyst versions 11.4.7 and below: update to version 11.4.8 or later\n\nSpotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4: update to version 12.0.5 or later\n\nSpotfire Analyst versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\n\nSpotfire Server versions 11.4.11 and below: update to version 11.4.12 or later\n\nSpotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5: update to version 12.0.6 or later\n\nSpotfire Server versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2023-26220",
"datePublished": "2023-10-10T22:06:36.002Z",
"dateReserved": "2023-02-20T22:18:23.427Z",
"dateUpdated": "2024-09-18T16:14:49.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41558 (GCVE-0-2022-41558)
Vulnerability from cvelistv5 – Published: 2022-11-15 18:15 – Updated: 2025-04-29 20:08
VLAI?
Title
TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
Summary
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.
Severity ?
9 (Critical)
CWE
- Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
unspecified , ≤ 11.4.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:42:46.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:08:19.885043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:08:32.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "12.1.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.6.1"
},
{
"status": "affected",
"version": "11.6.2"
},
{
"status": "affected",
"version": "11.6.3"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "11.8.1"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Visualizations component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
},
{
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 11.4.4 and below: update to version 11.4.5 or later\nTIBCO Spotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Analyst version 12.1.0: update to version 12.1.1 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 12.1.0 and below: update to version 12.1.1 or later\nTIBCO Spotfire Desktop versions 11.4.4 and below: update to version 11.4.5 or later\nTIBCO Spotfire Desktop versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Desktop version 12.1.0: update to version 12.1.1 or later\nTIBCO Spotfire Server versions 11.4.8 and below: update to version 11.4.9 or later\nTIBCO Spotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Server version 12.1.0: update to version 12.1.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
},
"title": "TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-41558",
"datePublished": "2022-11-15T18:15:12.527Z",
"dateReserved": "2022-09-26T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:08:32.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-30579 (GCVE-0-2022-30579)
Vulnerability from cvelistv5 – Published: 2022-09-20 18:55 – Updated: 2025-05-28 15:59
VLAI?
Title
TIBCO Spotfire Server Blind SSRF vulnerability
Summary
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
Severity ?
7.1 (High)
CWE
- Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace |
Affected:
12.0.0
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:56:12.867Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-30579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T15:59:40.087955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T15:59:43.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.0.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.0.0"
}
]
}
],
"datePublic": "2022-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-20T19:06:20.000Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0: update to version 12.0.1 or later\nTIBCO Spotfire Server version 12.0.0: update to version 12.0.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
},
"title": "TIBCO Spotfire Server Blind SSRF vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-09-20T17:00:00Z",
"ID": "CVE-2022-30579",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server Blind SSRF vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "12.0.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "12.0.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0: update to version 12.0.1 or later\nTIBCO Spotfire Server version 12.0.0: update to version 12.0.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-30579",
"datePublished": "2022-09-20T18:55:08.406Z",
"dateReserved": "2022-05-11T00:00:00.000Z",
"dateUpdated": "2025-05-28T15:59:43.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43051 (GCVE-0-2021-43051)
Vulnerability from cvelistv5 – Published: 2021-12-14 19:20 – Updated: 2024-09-16 21:09
VLAI?
Title
TIBCO Spotfire Server API Authorization Vulnerability
Summary
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
Severity ?
7.1 (High)
CWE
- In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Server |
Affected:
unspecified , ≤ 10.10.6
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.10.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
},
{
"status": "affected",
"version": "11.4.0"
},
{
"status": "affected",
"version": "11.4.1"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
}
]
}
],
"datePublic": "2021-12-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-14T20:06:22",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Server versions 10.10.6 and below update to version 10.10.7 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1 update to version 11.4.2 or later\nTIBCO Spotfire Server versions 11.5.0 and 11.6.0 update to version 11.6.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Server API Authorization Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-12-14T17:00:00Z",
"ID": "CVE-2021-43051",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server API Authorization Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.10.6"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
},
{
"version_affected": "=",
"version_value": "11.4.0"
},
{
"version_affected": "=",
"version_value": "11.4.1"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.5.0"
},
{
"version_affected": "=",
"version_value": "11.6.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Server versions 10.10.6 and below update to version 10.10.7 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1 update to version 11.4.2 or later\nTIBCO Spotfire Server versions 11.5.0 and 11.6.0 update to version 11.6.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43051",
"datePublished": "2021-12-14T19:20:10.307673Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-16T21:09:03.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28830 (GCVE-0-2021-28830)
Vulnerability from cvelistv5 – Published: 2021-06-29 17:15 – Updated: 2024-09-16 23:10
VLAI?
Title
TIBCO Spotfire Windows Platform Artifact Search vulnerability
Summary
The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Enterprise Runtime for R - Server Edition |
Affected:
unspecified , ≤ 1.2.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.597Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "1.2.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.5.0"
},
{
"status": "affected",
"version": "1.6.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.12",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.10.4"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-06-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-29T18:06:12",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO Spotfire Windows Platform Artifact Search vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-06-29T17:00:00Z",
"ID": "CVE-2021-28830",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Windows Platform Artifact Search vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.3.0"
},
{
"version_affected": "=",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.4.0"
},
{
"version_affected": "=",
"version_value": "1.5.0"
},
{
"version_affected": "=",
"version_value": "1.6.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.12"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.10.4"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-28830",
"datePublished": "2021-06-29T17:15:12.487779Z",
"dateReserved": "2021-03-18T00:00:00",
"dateUpdated": "2024-09-16T23:10:44.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23275 (GCVE-0-2021-23275)
Vulnerability from cvelistv5 – Published: 2021-06-29 17:15 – Updated: 2024-09-16 20:53
VLAI?
Title
TIBCO Spotfire Windows Platform Installation vulnerability
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Enterprise Runtime for R - Server Edition |
Affected:
unspecified , ≤ 1.2.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:05:55.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "1.2.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.5.0"
},
{
"status": "affected",
"version": "1.6.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.12",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.10.4"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-06-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-29T18:06:14",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO Spotfire Windows Platform Installation vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-06-29T17:00:00Z",
"ID": "CVE-2021-23275",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Windows Platform Installation vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.3.0"
},
{
"version_affected": "=",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.4.0"
},
{
"version_affected": "=",
"version_value": "1.5.0"
},
{
"version_affected": "=",
"version_value": "1.6.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.12"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.10.4"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-23275",
"datePublished": "2021-06-29T17:15:10.796514Z",
"dateReserved": "2021-01-08T00:00:00",
"dateUpdated": "2024-09-16T20:53:10.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23273 (GCVE-0-2021-23273)
Vulnerability from cvelistv5 – Published: 2021-03-09 20:35 – Updated: 2024-09-16 23:15
VLAI?
Title
TIBCO Spotfire Cross Site Scripting Vulnerability
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.
Severity ?
CWE
- The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
unspecified , ≤ 10.3.3
(custom)
Affected: 10.10.0 Affected: 10.10.1 Affected: 10.10.2 Affected: 10.7.0 Affected: 10.8.0 Affected: 10.9.0 Affected: 11.0.0 Affected: 11.1.0 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:05:55.402Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.1.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
}
],
"datePublic": "2021-03-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-09T21:06:28",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Analyst versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.1.0 and below update to version 11.2.0 or higher\nTIBCO Spotfire Desktop versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Desktop versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Server versions 10.3.11 and below update to version 10.3.12 or higher\nTIBCO Spotfire Server versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3 update to version 10.10.4 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Cross Site Scripting Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-03-09T17:00:00Z",
"ID": "CVE-2021-23273",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Cross Site Scripting Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analyst",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Desktop",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.11"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Analyst versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.1.0 and below update to version 11.2.0 or higher\nTIBCO Spotfire Desktop versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Desktop versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Server versions 10.3.11 and below update to version 10.3.12 or higher\nTIBCO Spotfire Server versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3 update to version 10.10.4 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-23273",
"datePublished": "2021-03-09T20:35:16.543095Z",
"dateReserved": "2021-01-08T00:00:00",
"dateUpdated": "2024-09-16T23:15:56.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9416 (GCVE-0-2020-9416)
Vulnerability from cvelistv5 – Published: 2020-09-15 18:55 – Updated: 2024-09-16 19:20
VLAI?
Title
TIBCO Spotfire Stored Cross Site Scripting Vulnerability
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
Severity ?
8.2 (High)
CWE
- The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker's injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
10.7.0
Affected: 10.8.0 Affected: 10.9.0 Affected: 10.10.0 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:26:16.103Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
}
]
}
],
"datePublic": "2020-09-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker\u0027s injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-15T19:06:09",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Stored Cross Site Scripting Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2020-09-15T17:00:00Z",
"ID": "CVE-2020-9416",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Stored Cross Site Scripting Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analyst",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
}
]
}
},
{
"product_name": "TIBCO Spotfire Desktop",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker\u0027s injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2020-9416",
"datePublished": "2020-09-15T18:55:11.663340Z",
"dateReserved": "2020-02-26T00:00:00",
"dateUpdated": "2024-09-16T19:20:42.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9408 (GCVE-0-2020-9408)
Vulnerability from cvelistv5 – Published: 2020-03-11 19:55 – Updated: 2024-09-16 22:30
VLAI?
Title
TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability
Summary
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.
Severity ?
9.9 (Critical)
CWE
- The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace |
Affected:
unspecified , ≤ 10.8.0
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:26:16.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "7.11.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.12.0"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "10.0.1"
},
{
"status": "affected",
"version": "10.1.0"
},
{
"status": "affected",
"version": "10.2.0"
},
{
"status": "affected",
"version": "10.3.0"
},
{
"status": "affected",
"version": "10.3.1"
},
{
"status": "affected",
"version": "10.3.2"
},
{
"status": "affected",
"version": "10.3.3"
},
{
"status": "affected",
"version": "10.3.4"
},
{
"status": "affected",
"version": "10.3.5"
},
{
"status": "affected",
"version": "10.3.6"
},
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
}
]
}
],
"datePublic": "2020-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-11T19:55:12",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2020-03-11T17:00:00Z",
"ID": "CVE-2020-9408",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.8.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.11.9"
},
{
"version_affected": "=",
"version_value": "7.12.0"
},
{
"version_affected": "=",
"version_value": "7.13.0"
},
{
"version_affected": "=",
"version_value": "7.14.0"
},
{
"version_affected": "=",
"version_value": "10.0.0"
},
{
"version_affected": "=",
"version_value": "10.0.1"
},
{
"version_affected": "=",
"version_value": "10.1.0"
},
{
"version_affected": "=",
"version_value": "10.2.0"
},
{
"version_affected": "=",
"version_value": "10.3.0"
},
{
"version_affected": "=",
"version_value": "10.3.1"
},
{
"version_affected": "=",
"version_value": "10.3.2"
},
{
"version_affected": "=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.3.4"
},
{
"version_affected": "=",
"version_value": "10.3.5"
},
{
"version_affected": "=",
"version_value": "10.3.6"
},
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2020-9408",
"datePublished": "2020-03-11T19:55:12.878877Z",
"dateReserved": "2020-02-26T00:00:00",
"dateUpdated": "2024-09-16T22:30:59.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26221 (GCVE-0-2023-26221)
Vulnerability from nvd – Published: 2023-11-08 19:44 – Updated: 2024-09-04 15:46
VLAI?
Title
TIBCO Spotfire Insufficiently Protected Credential vulnerability
Summary
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.
Severity ?
5 (Medium)
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | Spotfire Analyst |
Affected:
12.3.0
Affected: 12.4.0 Affected: 12.5.0 |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:46:23.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26221",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-04T15:46:35.719041Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-04T15:46:47.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Spotfire Connectors component of TIBCO Software Inc.\u0027s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.\u003c/p\u003e"
}
],
"value": "The Spotfire Connectors component of TIBCO Software Inc.\u0027s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-08T19:44:03.634Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTIBCO has released updated versions of the affected components which address these issues.\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\u003c/p\u003e\u003cp\u003eSpotfire for AWS Marketplace version 12.5.0: update to version 14.0.0 or later\u003c/p\u003e"
}
],
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nSpotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\n\nSpotfire Server versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later\n\nSpotfire for AWS Marketplace version 12.5.0: update to version 14.0.0 or later\n\n"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Insufficiently Protected Credential vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2023-26221",
"datePublished": "2023-11-08T19:44:03.634Z",
"dateReserved": "2023-02-20T22:18:23.428Z",
"dateUpdated": "2024-09-04T15:46:47.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-26220 (GCVE-0-2023-26220)
Vulnerability from nvd – Published: 2023-10-10 22:06 – Updated: 2024-09-18 16:14
VLAI?
Title
TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability
Summary
The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.
Severity ?
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | Spotfire Analyst |
Affected:
0 , ≤ 11.4.7
(semver)
Affected: 11.5.0 Affected: 11.6.0 Affected: 11.7.0 Affected: 11.8.0 Affected: 12.0.0 Affected: 12.0.1 Affected: 12.0.2 Affected: 12.0.3 Affected: 12.0.4 Affected: 12.1.0 Affected: 12.1.1 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:46:24.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-26220",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-18T16:14:40.488828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T16:14:49.914Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
},
{
"status": "affected",
"version": "12.0.2"
},
{
"status": "affected",
"version": "12.0.3"
},
{
"status": "affected",
"version": "12.0.4"
},
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.6.1"
},
{
"status": "affected",
"version": "11.6.2"
},
{
"status": "affected",
"version": "11.6.3"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "11.8.1"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
},
{
"status": "affected",
"version": "12.0.2"
},
{
"status": "affected",
"version": "12.0.3"
},
{
"status": "affected",
"version": "12.0.4"
},
{
"status": "affected",
"version": "12.0.5"
},
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Spotfire Library component of TIBCO Software Inc.\u0027s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.\u003c/p\u003e"
}
],
"value": "The Spotfire Library component of TIBCO Software Inc.\u0027s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-10T22:06:36.002Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTIBCO has released updated versions of the affected components which address these issues.\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 11.4.7 and below: update to version 11.4.8 or later\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4: update to version 12.0.5 or later\u003c/p\u003e\u003cp\u003eSpotfire Analyst versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 11.4.11 and below: update to version 11.4.12 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5: update to version 12.0.6 or later\u003c/p\u003e\u003cp\u003eSpotfire Server versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\u003c/p\u003e"
}
],
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nSpotfire Analyst versions 11.4.7 and below: update to version 11.4.8 or later\n\nSpotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4: update to version 12.0.5 or later\n\nSpotfire Analyst versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\n\nSpotfire Server versions 11.4.11 and below: update to version 11.4.12 or later\n\nSpotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5: update to version 12.0.6 or later\n\nSpotfire Server versions 12.1.0 and 12.1.1: update to version 12.5.0 or later\n\n"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2023-26220",
"datePublished": "2023-10-10T22:06:36.002Z",
"dateReserved": "2023-02-20T22:18:23.427Z",
"dateUpdated": "2024-09-18T16:14:49.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-41558 (GCVE-0-2022-41558)
Vulnerability from nvd – Published: 2022-11-15 18:15 – Updated: 2025-04-29 20:08
VLAI?
Title
TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
Summary
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.
Severity ?
9 (Critical)
CWE
- Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
unspecified , ≤ 11.4.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:42:46.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-41558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-29T20:08:19.885043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-29T20:08:32.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "12.1.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.4.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
},
{
"status": "affected",
"version": "11.6.1"
},
{
"status": "affected",
"version": "11.6.2"
},
{
"status": "affected",
"version": "11.6.3"
},
{
"status": "affected",
"version": "11.7.0"
},
{
"status": "affected",
"version": "11.8.0"
},
{
"status": "affected",
"version": "11.8.1"
},
{
"status": "affected",
"version": "12.0.0"
},
{
"status": "affected",
"version": "12.0.1"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.1.0"
}
]
}
],
"datePublic": "2022-11-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Visualizations component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful execution of these vulnerabilities will result in an attacker being able to execute commands with the privileges of the affected user.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-15T00:00:00.000Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://www.tibco.com/services/support/advisories"
},
{
"url": "https://www.tibco.com/support/advisories/2022/11/tibco-security-advisory-november-15-2022-tibco-spotfire-cve-2022-41558"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 11.4.4 and below: update to version 11.4.5 or later\nTIBCO Spotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Analyst version 12.1.0: update to version 12.1.1 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 12.1.0 and below: update to version 12.1.1 or later\nTIBCO Spotfire Desktop versions 11.4.4 and below: update to version 11.4.5 or later\nTIBCO Spotfire Desktop versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Desktop version 12.1.0: update to version 12.1.1 or later\nTIBCO Spotfire Server versions 11.4.8 and below: update to version 11.4.9 or later\nTIBCO Spotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1: update to version 12.0.2 or later\nTIBCO Spotfire Server version 12.1.0: update to version 12.1.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
},
"title": "TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-41558",
"datePublished": "2022-11-15T18:15:12.527Z",
"dateReserved": "2022-09-26T00:00:00.000Z",
"dateUpdated": "2025-04-29T20:08:32.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-30579 (GCVE-0-2022-30579)
Vulnerability from nvd – Published: 2022-09-20 18:55 – Updated: 2025-05-28 15:59
VLAI?
Title
TIBCO Spotfire Server Blind SSRF vulnerability
Summary
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
Severity ?
7.1 (High)
CWE
- Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace |
Affected:
12.0.0
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:56:12.867Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-30579",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T15:59:40.087955Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-28T15:59:43.490Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.0.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "12.0.0"
}
]
}
],
"datePublic": "2022-09-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-20T19:06:20.000Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0: update to version 12.0.1 or later\nTIBCO Spotfire Server version 12.0.0: update to version 12.0.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
},
"title": "TIBCO Spotfire Server Blind SSRF vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2022-09-20T17:00:00Z",
"ID": "CVE-2022-30579",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server Blind SSRF vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "12.0.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "12.0.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Web Player component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to Spotfire Server data and the ability to cause a partial denial of service. This vulnerability could allow an attacker to access resources other than the vulnerable system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2022/09/tibco-security-advisory-september-20-2022-tibco-spotfire-cve-2022-30579"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace version 12.0.0: update to version 12.0.1 or later\nTIBCO Spotfire Server version 12.0.0: update to version 12.0.1 or later"
}
],
"source": {
"discovery": "Discovery statement"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2022-30579",
"datePublished": "2022-09-20T18:55:08.406Z",
"dateReserved": "2022-05-11T00:00:00.000Z",
"dateUpdated": "2025-05-28T15:59:43.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-43051 (GCVE-0-2021-43051)
Vulnerability from nvd – Published: 2021-12-14 19:20 – Updated: 2024-09-16 21:09
VLAI?
Title
TIBCO Spotfire Server API Authorization Vulnerability
Summary
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
Severity ?
7.1 (High)
CWE
- In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Server |
Affected:
unspecified , ≤ 10.10.6
(custom)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.411Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.10.6",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
},
{
"status": "affected",
"version": "11.4.0"
},
{
"status": "affected",
"version": "11.4.1"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.5.0"
},
{
"status": "affected",
"version": "11.6.0"
}
]
}
],
"datePublic": "2021-12-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-14T20:06:22",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Server versions 10.10.6 and below update to version 10.10.7 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1 update to version 11.4.2 or later\nTIBCO Spotfire Server versions 11.5.0 and 11.6.0 update to version 11.6.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Server API Authorization Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-12-14T17:00:00Z",
"ID": "CVE-2021-43051",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server API Authorization Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.10.6"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
},
{
"version_affected": "=",
"version_value": "11.4.0"
},
{
"version_affected": "=",
"version_value": "11.4.1"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.5.0"
},
{
"version_affected": "=",
"version_value": "11.6.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Server versions 10.10.6 and below update to version 10.10.7 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1 update to version 11.4.2 or later\nTIBCO Spotfire Server versions 11.5.0 and 11.6.0 update to version 11.6.1 or later"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-43051",
"datePublished": "2021-12-14T19:20:10.307673Z",
"dateReserved": "2021-10-27T00:00:00",
"dateUpdated": "2024-09-16T21:09:03.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-28830 (GCVE-0-2021-28830)
Vulnerability from nvd – Published: 2021-06-29 17:15 – Updated: 2024-09-16 23:10
VLAI?
Title
TIBCO Spotfire Windows Platform Artifact Search vulnerability
Summary
The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Enterprise Runtime for R - Server Edition |
Affected:
unspecified , ≤ 1.2.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.597Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "1.2.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.5.0"
},
{
"status": "affected",
"version": "1.6.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.12",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.10.4"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-06-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-29T18:06:12",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO Spotfire Windows Platform Artifact Search vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-06-29T17:00:00Z",
"ID": "CVE-2021-28830",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Windows Platform Artifact Search vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.3.0"
},
{
"version_affected": "=",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.4.0"
},
{
"version_affected": "=",
"version_value": "1.5.0"
},
{
"version_affected": "=",
"version_value": "1.6.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.12"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.10.4"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-28830",
"datePublished": "2021-06-29T17:15:12.487779Z",
"dateReserved": "2021-03-18T00:00:00",
"dateUpdated": "2024-09-16T23:10:44.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23275 (GCVE-0-2021-23275)
Vulnerability from nvd – Published: 2021-06-29 17:15 – Updated: 2024-09-16 20:53
VLAI?
Title
TIBCO Spotfire Windows Platform Installation vulnerability
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
Severity ?
8.8 (High)
CWE
- The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Enterprise Runtime for R - Server Edition |
Affected:
unspecified , ≤ 1.2.4
(custom)
|
|||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Credits
TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:05:55.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "1.2.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "TIBCO Enterprise Runtime for R - Server Edition",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "1.4.0"
},
{
"status": "affected",
"version": "1.5.0"
},
{
"status": "affected",
"version": "1.6.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.12",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.10.4"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
}
]
},
{
"product": "TIBCO Spotfire Statistics Services",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.2.0"
},
{
"status": "affected",
"version": "11.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"datePublic": "2021-06-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-29T18:06:14",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
},
"title": "TIBCO Spotfire Windows Platform Installation vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-06-29T17:00:00Z",
"ID": "CVE-2021-23275",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Windows Platform Installation vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.3.0"
},
{
"version_affected": "=",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "TIBCO Enterprise Runtime for R - Server Edition",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.4.0"
},
{
"version_affected": "=",
"version_value": "1.5.0"
},
{
"version_affected": "=",
"version_value": "1.6.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.12"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.10.4"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
}
]
}
},
{
"product_name": "TIBCO Spotfire Statistics Services",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "11.1.0"
},
{
"version_affected": "=",
"version_value": "11.2.0"
},
{
"version_affected": "=",
"version_value": "11.3.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "TIBCO would like to extend its appreciation to Will Dormann of CERT/CC for discovery of this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the possibility of an attacker gaining full access to the Windows operating system at the privilege level of the affected component."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-23275"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later\nTIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later\nTIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later\nTIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later\nTIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later\nTIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later\nTIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later"
}
],
"source": {
"discovery": "Will Dormann of CERT/CC"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-23275",
"datePublished": "2021-06-29T17:15:10.796514Z",
"dateReserved": "2021-01-08T00:00:00",
"dateUpdated": "2024-09-16T20:53:10.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-23273 (GCVE-0-2021-23273)
Vulnerability from nvd – Published: 2021-03-09 20:35 – Updated: 2024-09-16 23:15
VLAI?
Title
TIBCO Spotfire Cross Site Scripting Vulnerability
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.
Severity ?
CWE
- The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
unspecified , ≤ 10.3.3
(custom)
Affected: 10.10.0 Affected: 10.10.1 Affected: 10.10.2 Affected: 10.7.0 Affected: 10.8.0 Affected: 10.9.0 Affected: 11.0.0 Affected: 11.1.0 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:05:55.402Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "11.1.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.3.11",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
},
{
"status": "affected",
"version": "10.10.2"
},
{
"status": "affected",
"version": "10.10.3"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "11.0.0"
},
{
"status": "affected",
"version": "11.1.0"
}
]
}
],
"datePublic": "2021-03-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-03-09T21:06:28",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Analyst versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.1.0 and below update to version 11.2.0 or higher\nTIBCO Spotfire Desktop versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Desktop versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Server versions 10.3.11 and below update to version 10.3.12 or higher\nTIBCO Spotfire Server versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3 update to version 10.10.4 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Cross Site Scripting Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2021-03-09T17:00:00Z",
"ID": "CVE-2021-23273",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Cross Site Scripting Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analyst",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Desktop",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.3.11"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
},
{
"version_affected": "=",
"version_value": "10.10.2"
},
{
"version_affected": "=",
"version_value": "10.10.3"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "11.0.0"
},
{
"version_affected": "=",
"version_value": "11.1.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that an attacker gains access, including potentially administrative access, to the affected system."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Analyst versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.1.0 and below update to version 11.2.0 or higher\nTIBCO Spotfire Desktop versions 10.3.3 and below update to version 10.3.4 or higher\nTIBCO Spotfire Desktop versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher\nTIBCO Spotfire Server versions 10.3.11 and below update to version 10.3.12 or higher\nTIBCO Spotfire Server versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3 update to version 10.10.4 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0 update to version 11.2.0 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2021-23273",
"datePublished": "2021-03-09T20:35:16.543095Z",
"dateReserved": "2021-01-08T00:00:00",
"dateUpdated": "2024-09-16T23:15:56.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9416 (GCVE-0-2020-9416)
Vulnerability from nvd – Published: 2020-09-15 18:55 – Updated: 2024-09-16 19:20
VLAI?
Title
TIBCO Spotfire Stored Cross Site Scripting Vulnerability
Summary
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
Severity ?
8.2 (High)
CWE
- The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker's injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst |
Affected:
10.7.0
Affected: 10.8.0 Affected: 10.9.0 Affected: 10.10.0 |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:26:16.103Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analyst",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
}
]
},
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
}
]
},
{
"product": "TIBCO Spotfire Desktop",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
},
{
"status": "affected",
"version": "10.8.1"
},
{
"status": "affected",
"version": "10.9.0"
},
{
"status": "affected",
"version": "10.10.0"
},
{
"status": "affected",
"version": "10.10.1"
}
]
}
],
"datePublic": "2020-09-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker\u0027s injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-15T19:06:09",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Stored Cross Site Scripting Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2020-09-15T17:00:00Z",
"ID": "CVE-2020-9416",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Stored Cross Site Scripting Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analyst",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
}
]
}
},
{
"product_name": "TIBCO Spotfire Desktop",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
},
{
"version_affected": "=",
"version_value": "10.8.1"
},
{
"version_affected": "=",
"version_value": "10.9.0"
},
{
"version_affected": "=",
"version_value": "10.10.0"
},
{
"version_affected": "=",
"version_value": "10.10.1"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire client component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker\u0027s injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher\nTIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher\nTIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2020-9416",
"datePublished": "2020-09-15T18:55:11.663340Z",
"dateReserved": "2020-02-26T00:00:00",
"dateUpdated": "2024-09-16T19:20:42.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-9408 (GCVE-0-2020-9408)
Vulnerability from nvd – Published: 2020-03-11 19:55 – Updated: 2024-09-16 22:30
VLAI?
Title
TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability
Summary
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.
Severity ?
9.9 (Critical)
CWE
- The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace |
Affected:
unspecified , ≤ 10.8.0
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T10:26:16.100Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "10.8.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "TIBCO Spotfire Server",
"vendor": "TIBCO Software Inc.",
"versions": [
{
"lessThanOrEqual": "7.11.9",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.12.0"
},
{
"status": "affected",
"version": "7.13.0"
},
{
"status": "affected",
"version": "7.14.0"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "10.0.1"
},
{
"status": "affected",
"version": "10.1.0"
},
{
"status": "affected",
"version": "10.2.0"
},
{
"status": "affected",
"version": "10.3.0"
},
{
"status": "affected",
"version": "10.3.1"
},
{
"status": "affected",
"version": "10.3.2"
},
{
"status": "affected",
"version": "10.3.3"
},
{
"status": "affected",
"version": "10.3.4"
},
{
"status": "affected",
"version": "10.3.5"
},
{
"status": "affected",
"version": "10.3.6"
},
{
"status": "affected",
"version": "10.4.0"
},
{
"status": "affected",
"version": "10.5.0"
},
{
"status": "affected",
"version": "10.6.0"
},
{
"status": "affected",
"version": "10.6.1"
},
{
"status": "affected",
"version": "10.7.0"
},
{
"status": "affected",
"version": "10.8.0"
}
]
}
],
"datePublic": "2020-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-11T19:55:12",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.tibco.com/services/support/advisories"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
],
"solutions": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@tibco.com",
"DATE_PUBLIC": "2020-03-11T17:00:00Z",
"ID": "CVE-2020-9408",
"STATE": "PUBLIC",
"TITLE": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "10.8.0"
}
]
}
},
{
"product_name": "TIBCO Spotfire Server",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_value": "7.11.9"
},
{
"version_affected": "=",
"version_value": "7.12.0"
},
{
"version_affected": "=",
"version_value": "7.13.0"
},
{
"version_affected": "=",
"version_value": "7.14.0"
},
{
"version_affected": "=",
"version_value": "10.0.0"
},
{
"version_affected": "=",
"version_value": "10.0.1"
},
{
"version_affected": "=",
"version_value": "10.1.0"
},
{
"version_affected": "=",
"version_value": "10.2.0"
},
{
"version_affected": "=",
"version_value": "10.3.0"
},
{
"version_affected": "=",
"version_value": "10.3.1"
},
{
"version_affected": "=",
"version_value": "10.3.2"
},
{
"version_affected": "=",
"version_value": "10.3.3"
},
{
"version_affected": "=",
"version_value": "10.3.4"
},
{
"version_affected": "=",
"version_value": "10.3.5"
},
{
"version_affected": "=",
"version_value": "10.3.6"
},
{
"version_affected": "=",
"version_value": "10.4.0"
},
{
"version_affected": "=",
"version_value": "10.5.0"
},
{
"version_affected": "=",
"version_value": "10.6.0"
},
{
"version_affected": "=",
"version_value": "10.6.1"
},
{
"version_affected": "=",
"version_value": "10.7.0"
},
{
"version_affected": "=",
"version_value": "10.8.0"
}
]
}
}
]
},
"vendor_name": "TIBCO Software Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service."
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.tibco.com/services/support/advisories",
"refsource": "CONFIRM",
"url": "http://www.tibco.com/services/support/advisories"
},
{
"name": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server",
"refsource": "CONFIRM",
"url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
}
]
},
"solution": [
{
"lang": "en",
"value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2020-9408",
"datePublished": "2020-03-11T19:55:12.878877Z",
"dateReserved": "2020-02-26T00:00:00",
"dateUpdated": "2024-09-16T22:30:59.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}