cvelistv5 - CVE-2024-3330

CVE-2024-3330 (GCVE-0-2024-3330)

Vulnerability from cvelistv5 – Published: 2024-06-27 18:37 – Updated: 2024-08-01 20:05

Summary

Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-250 - Execution with Unnecessary Privileges

Assigner

tibco

References

URL

Tags

https://community.spotfire.com/articles/spotfire/…

Impacted products

Vendor

Product

Version

Spotfire

Spotfire Analyst

Affected: 12.0.9 , ≤ 12.5.0 (patch)
Affected: 14.0 , ≤ 14.0.2 (patch)

	Spotfire	Spotfire Server	Affected: 12.0.10 , ≤ 12.5.0 (patch) Affected: 14.0 , ≤ 14.0.3 (patch) Affected: 14.2.0 , ≤ 14.3.0 (patch)
	Spotfire	Spotfire for AWS Marketplace	Affected: 14.0 , < 14.3.0 (patch)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spotfire_analyst",
            "vendor": "tibco",
            "versions": [
              {
                "status": "affected",
                "version": "12.1.0"
              },
              {
                "status": "affected",
                "version": "12.1.1"
              },
              {
                "status": "affected",
                "version": "12.2.0"
              },
              {
                "status": "affected",
                "version": "12.3.0"
              },
              {
                "status": "affected",
                "version": "12.4.0"
              },
              {
                "status": "affected",
                "version": "12.5.0"
              },
              {
                "status": "affected",
                "version": "14.0.0"
              },
              {
                "status": "affected",
                "version": "14.0.1"
              },
              {
                "status": "affected",
                "version": "14.0.2"
              },
              {
                "status": "affected",
                "version": "14.1.0"
              },
              {
                "status": "affected",
                "version": "14.2.0"
              },
              {
                "status": "affected",
                "version": "14.3.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spotfire_server",
            "vendor": "tibco",
            "versions": [
              {
                "status": "affected",
                "version": "12.1.0"
              },
              {
                "status": "affected",
                "version": "12.1.1"
              },
              {
                "status": "affected",
                "version": "12.2.0"
              },
              {
                "status": "affected",
                "version": "12.3.0"
              },
              {
                "status": "affected",
                "version": "12.4.0"
              },
              {
                "status": "affected",
                "version": "12.5.0"
              },
              {
                "status": "affected",
                "version": "14.0.0"
              },
              {
                "status": "affected",
                "version": "14.0.1"
              },
              {
                "status": "affected",
                "version": "14.0.2"
              },
              {
                "status": "affected",
                "version": "14.0.3"
              },
              {
                "status": "affected",
                "version": "14.2.0"
              },
              {
                "status": "affected",
                "version": "14.3.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spotfire_analytics_platform_for_aws",
            "vendor": "tibco",
            "versions": [
              {
                "lessThanOrEqual": "14.3.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spotfire_analyst",
            "vendor": "tibco",
            "versions": [
              {
                "lessThanOrEqual": "12.0.9",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "spotfire_server",
            "vendor": "tibco",
            "versions": [
              {
                "lessThanOrEqual": "12.0.10",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-02T19:33:08.056282Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-250",
                "description": "CWE-250 Execution with Unnecessary Privileges",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T20:02:22.998Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:05:08.410Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spotfire Analyst",
          "vendor": "Spotfire",
          "versions": [
            {
              "lessThanOrEqual": "12.5.0",
              "status": "affected",
              "version": "12.0.9",
              "versionType": "patch"
            },
            {
              "lessThanOrEqual": "14.0.2",
              "status": "affected",
              "version": "14.0",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotfire Server",
          "vendor": "Spotfire",
          "versions": [
            {
              "lessThanOrEqual": "12.5.0",
              "status": "affected",
              "version": "12.0.10",
              "versionType": "patch"
            },
            {
              "lessThanOrEqual": "14.0.3",
              "status": "affected",
              "version": "14.0",
              "versionType": "patch"
            },
            {
              "lessThanOrEqual": "14.3.0",
              "status": "affected",
              "version": "14.2.0",
              "versionType": "patch"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Spotfire for AWS Marketplace",
          "vendor": "Spotfire",
          "versions": [
            {
              "lessThan": "14.3.0",
              "status": "affected",
              "version": "14.0",
              "versionType": "patch"
            }
          ]
        }
      ],
      "datePublic": "2024-06-26T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..\u003cp\u003eThis issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\u003c/p\u003e"
            }
          ],
          "value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker."
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process"
            }
          ]
        },
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-27T18:37:34.119Z",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/b\u003e"
            }
          ],
          "value": "*  Spotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\n\n\n  *  Spotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\n\n\n  *  Spotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n  *  Spotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\n\n\n  *  Spotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\n\n\n  *  Spotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n  *  Spotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Spotfire Remote Code Execution Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2024-3330",
    "datePublished": "2024-06-27T18:37:34.119Z",
    "dateReserved": "2024-04-04T17:01:54.246Z",
    "dateUpdated": "2024-08-01T20:05:08.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad en Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire para AWS Marketplace permite En el caso del cliente de Windows instalado: la ejecuci\\u00f3n exitosa de esta vulnerabilidad dar\\u00e1 como resultado que un atacante pueda ejecutar c\\u00f3digo arbitrario. Esto requiere la interacci\\u00f3n humana de otra persona. que el atacante. En el caso del reproductor web (autor comercial): la ejecuci\\u00f3n exitosa de esta vulnerabilidad a trav\\u00e9s del reproductor web dar\\u00e1 como resultado que el atacante pueda ejecutar c\\u00f3digo arbitrario como la cuenta que ejecuta el proceso del reproductor web. de Automation Services: la ejecuci\\u00f3n exitosa de esta vulnerabilidad dar\\u00e1 como resultado que un atacante pueda ejecutar c\\u00f3digo arbitrario a trav\\u00e9s de Automation Services. Este problema afecta a Spotfire Analyst: desde 12.0.9 hasta 12.5.0, desde 14.0 hasta 14.0.2; Servidor Spotfire: de 12.0.10 a 12.5.0, de 14.0 a 14.0.3, de 14.2.0 a 14.3.0; Spotfire para AWS Marketplace: desde 14.0 antes de 14.3.0.\"}]",
      "id": "CVE-2024-3330",
      "lastModified": "2024-11-21T09:29:24.060",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@tibco.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 9.9, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.1, \"impactScore\": 6.0}]}",
      "published": "2024-06-27T19:15:14.937",
      "references": "[{\"url\": \"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\", \"source\": \"security@tibco.com\"}, {\"url\": \"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@tibco.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-250\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-3330\",\"sourceIdentifier\":\"security@tibco.com\",\"published\":\"2024-06-27T19:15:14.937\",\"lastModified\":\"2024-11-21T09:29:24.060\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad en Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire para AWS Marketplace permite En el caso del cliente de Windows instalado: la ejecuci\u00f3n exitosa de esta vulnerabilidad dar\u00e1 como resultado que un atacante pueda ejecutar c\u00f3digo arbitrario. Esto requiere la interacci\u00f3n humana de otra persona. que el atacante. En el caso del reproductor web (autor comercial): la ejecuci\u00f3n exitosa de esta vulnerabilidad a trav\u00e9s del reproductor web dar\u00e1 como resultado que el atacante pueda ejecutar c\u00f3digo arbitrario como la cuenta que ejecuta el proceso del reproductor web. de Automation Services: la ejecuci\u00f3n exitosa de esta vulnerabilidad dar\u00e1 como resultado que un atacante pueda ejecutar c\u00f3digo arbitrario a trav\u00e9s de Automation Services. Este problema afecta a Spotfire Analyst: desde 12.0.9 hasta 12.5.0, desde 14.0 hasta 14.0.2; Servidor Spotfire: de 12.0.10 a 12.5.0, de 14.0 a 14.0.3, de 14.2.0 a 14.3.0; Spotfire para AWS Marketplace: desde 14.0 antes de 14.3.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@tibco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.1,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]}],\"references\":[{\"url\":\"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\",\"source\":\"security@tibco.com\"},{\"url\":\"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T20:05:08.410Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3330\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-02T19:33:08.056282Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:*\"], \"vendor\": \"tibco\", \"product\": \"spotfire_analyst\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.1.0\"}, {\"status\": \"affected\", \"version\": \"12.1.1\"}, {\"status\": \"affected\", \"version\": \"12.2.0\"}, {\"status\": \"affected\", \"version\": \"12.3.0\"}, {\"status\": \"affected\", \"version\": \"12.4.0\"}, {\"status\": \"affected\", \"version\": \"12.5.0\"}, {\"status\": \"affected\", \"version\": \"14.0.0\"}, {\"status\": \"affected\", \"version\": \"14.0.1\"}, {\"status\": \"affected\", \"version\": \"14.0.2\"}, {\"status\": \"affected\", \"version\": \"14.1.0\"}, {\"status\": \"affected\", \"version\": \"14.2.0\"}, {\"status\": \"affected\", \"version\": \"14.3.0\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:*\"], \"vendor\": \"tibco\", \"product\": \"spotfire_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.1.0\"}, {\"status\": \"affected\", \"version\": \"12.1.1\"}, {\"status\": \"affected\", \"version\": \"12.2.0\"}, {\"status\": \"affected\", \"version\": \"12.3.0\"}, {\"status\": \"affected\", \"version\": \"12.4.0\"}, {\"status\": \"affected\", \"version\": \"12.5.0\"}, {\"status\": \"affected\", \"version\": \"14.0.0\"}, {\"status\": \"affected\", \"version\": \"14.0.1\"}, {\"status\": \"affected\", \"version\": \"14.0.2\"}, {\"status\": \"affected\", \"version\": \"14.0.3\"}, {\"status\": \"affected\", \"version\": \"14.2.0\"}, {\"status\": \"affected\", \"version\": \"14.3.0\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:*\"], \"vendor\": \"tibco\", \"product\": \"spotfire_analytics_platform_for_aws\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"14.3.0\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*\"], \"vendor\": \"tibco\", \"product\": \"spotfire_analyst\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"12.0.9\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*\"], \"vendor\": \"tibco\", \"product\": \"spotfire_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"12.0.10\"}], \"defaultStatus\": \"unaffected\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"CWE-250 Execution with Unnecessary Privileges\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-02T19:07:59.619Z\"}}], \"cna\": {\"title\": \"Spotfire Remote Code Execution Vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker.\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"value\": \"In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"value\": \"In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spotfire\", \"product\": \"Spotfire Analyst\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0.9\", \"versionType\": \"patch\", \"lessThanOrEqual\": \"12.5.0\"}, {\"status\": \"affected\", \"version\": \"14.0\", \"versionType\": \"patch\", \"lessThanOrEqual\": \"14.0.2\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Spotfire\", \"product\": \"Spotfire Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.0.10\", \"versionType\": \"patch\", \"lessThanOrEqual\": \"12.5.0\"}, {\"status\": \"affected\", \"version\": \"14.0\", \"versionType\": \"patch\", \"lessThanOrEqual\": \"14.0.3\"}, {\"status\": \"affected\", \"version\": \"14.2.0\", \"versionType\": \"patch\", \"lessThanOrEqual\": \"14.3.0\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Spotfire\", \"product\": \"Spotfire for AWS Marketplace\", \"versions\": [{\"status\": \"affected\", \"version\": \"14.0\", \"lessThan\": \"14.3.0\", \"versionType\": \"patch\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"*  Spotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\\n\\n\\n  *  Spotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\\n\\n\\n  *  Spotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\\n\\n\\n  *  Spotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\\n\\n\\n  *  Spotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\\n\\n\\n  *  Spotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\\n\\n\\n  *  Spotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cb\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\\\"background-color: rgb(254, 254, 254);\\\"\u003eSpotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/b\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-06-26T06:30:00.000Z\", \"references\": [{\"url\": \"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..\u003cp\u003eThis issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"4f830c72-39e4-45f6-a99f-78cc01ae04db\", \"shortName\": \"tibco\", \"dateUpdated\": \"2024-06-27T18:37:34.119Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-3330\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T20:05:08.410Z\", \"dateReserved\": \"2024-04-04T17:01:54.246Z\", \"assignerOrgId\": \"4f830c72-39e4-45f6-a99f-78cc01ae04db\", \"datePublished\": \"2024-06-27T18:37:34.119Z\", \"assignerShortName\": \"tibco\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-65P7-VC93-6P69

Vulnerability from github – Published: 2024-06-27 21:32 – Updated: 2024-06-27 21:32

Details

Severity ?

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-3330"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-27T19:15:14Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.",
  "id": "GHSA-65p7-vc93-6p69",
  "modified": "2024-06-27T21:32:07Z",
  "published": "2024-06-27T21:32:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3330"
    },
    {
      "type": "WEB",
      "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2024-1501

Vulnerability from csaf_certbund - Published: 2024-07-01 22:00 - Updated: 2024-07-01 22:00

Summary

Spotfire Analytics: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Spotfire Analytics ist eine kommerzielle Software-Plattform für Business-Intelligence-Lösungen zur systematischen Analyse von unternehmenseigenen und -fremden Daten. Der Spotfire Server ist die zentrale Komponente einer Spotfire Umgebung, mit der sich alle Spotfire Clients verbinden. Spotfire Statistics Services ist ein "light-weight" Server, der eine Kommunikationsschicht und eine Serviceschicht, sowie einen S-PLUS oder R "engine pool" und andere Features bietet.

Angriff

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Spotfire Analytics, Spotfire Server und Spotfire Statistics Services ausnutzen, um beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Spotfire Analytics ist eine kommerzielle Software-Plattform f\u00fcr Business-Intelligence-L\u00f6sungen zur systematischen Analyse von unternehmenseigenen und -fremden Daten.\r\nDer Spotfire Server ist die zentrale Komponente einer Spotfire Umgebung, mit der sich alle Spotfire Clients verbinden. \r\nSpotfire Statistics Services ist ein \"light-weight\" Server, der eine Kommunikationsschicht und eine Serviceschicht, sowie einen S-PLUS oder R \"engine pool\" und andere Features bietet.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Spotfire Analytics, Spotfire Server und Spotfire Statistics Services ausnutzen, um beliebigen Code auszuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1501 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1501.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1501 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1501"
      },
      {
        "category": "external",
        "summary": "Spotfire Security Advisory vom 2024-07-01",
        "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
      },
      {
        "category": "external",
        "summary": "Spotfire Security Advisory vom 2024-07-01",
        "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3331-r3436/"
      }
    ],
    "source_lang": "en-US",
    "title": "Spotfire Analytics: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-07-01T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:10:48.537+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1501",
      "initial_release_date": "2024-07-01T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-07-01T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c12.0.10",
                "product": {
                  "name": "Spotfire Analytics \u003c12.0.10",
                  "product_id": "T035764"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.0.3",
                "product": {
                  "name": "Spotfire Analytics \u003c14.0.3",
                  "product_id": "T035765"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.4.0",
                "product": {
                  "name": "Spotfire Analytics \u003c14.4.0",
                  "product_id": "T035766"
                }
              }
            ],
            "category": "product_name",
            "name": "Analytics"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c12.0.11",
                "product": {
                  "name": "Spotfire Server \u003c12.0.11",
                  "product_id": "T035767"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.0.4",
                "product": {
                  "name": "Spotfire Server \u003c14.0.4",
                  "product_id": "T035768"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.4.0",
                "product": {
                  "name": "Spotfire Server \u003c14.4.0",
                  "product_id": "T035769"
                }
              }
            ],
            "category": "product_name",
            "name": "Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c12.0.8",
                "product": {
                  "name": "Spotfire Statistics Services \u003c12.0.8",
                  "product_id": "T035770"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.0.4",
                "product": {
                  "name": "Spotfire Statistics Services \u003c14.0.4",
                  "product_id": "T035771"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.4.0",
                "product": {
                  "name": "Spotfire Statistics Services \u003c14.4.0",
                  "product_id": "T035772"
                }
              }
            ],
            "category": "product_name",
            "name": "Statistics Services"
          }
        ],
        "category": "vendor",
        "name": "Spotfire"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-3330",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Spotfire Analytics und Spotfire Server. Dieser Fehler besteht aufgrund einer unsachgem\u00e4\u00dfen Eingabeneutralisierung. Durch das Hochladen einer manipulierten Analyst-Datei kann ein entfernter, authentifizierter Angreifer diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen."
        }
      ],
      "release_date": "2024-07-01T22:00:00.000+00:00",
      "title": "CVE-2024-3330"
    },
    {
      "cve": "CVE-2024-3331",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Spotfire Analytics, Spotfire Server und Spotfire Statistics Services. Dieser Fehler in der evalREX-Funktion der TERR-Skriptumgebung f\u00fchrt zur Offenlegung von NTLM-Tokens. Ein entfernter authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
        }
      ],
      "release_date": "2024-07-01T22:00:00.000+00:00",
      "title": "CVE-2024-3331"
    }
  ]
}

GSD-2024-3330

Vulnerability from gsd - Updated: 2024-04-11 05:03

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-3330

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-3330"
      ],
      "id": "GSD-2024-3330",
      "modified": "2024-04-11T05:03:27.292829Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-3330",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

FKIE_CVE-2024-3330

Vulnerability from fkie_nvd - Published: 2024-06-27 19:15 - Updated: 2024-11-21 09:29

Severity ?

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@tibco.com	https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/
	af854a3a-2127-422b-91ae-364da2661108	https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire para AWS Marketplace permite En el caso del cliente de Windows instalado: la ejecuci\u00f3n exitosa de esta vulnerabilidad dar\u00e1 como resultado que un atacante pueda ejecutar c\u00f3digo arbitrario. Esto requiere la interacci\u00f3n humana de otra persona. que el atacante. En el caso del reproductor web (autor comercial): la ejecuci\u00f3n exitosa de esta vulnerabilidad a trav\u00e9s del reproductor web dar\u00e1 como resultado que el atacante pueda ejecutar c\u00f3digo arbitrario como la cuenta que ejecuta el proceso del reproductor web. de Automation Services: la ejecuci\u00f3n exitosa de esta vulnerabilidad dar\u00e1 como resultado que un atacante pueda ejecutar c\u00f3digo arbitrario a trav\u00e9s de Automation Services. Este problema afecta a Spotfire Analyst: desde 12.0.9 hasta 12.5.0, desde 14.0 hasta 14.0.2; Servidor Spotfire: de 12.0.10 a 12.5.0, de 14.0 a 14.0.3, de 14.2.0 a 14.3.0; Spotfire para AWS Marketplace: desde 14.0 antes de 14.3.0."
    }
  ],
  "id": "CVE-2024-3330",
  "lastModified": "2024-11-21T09:29:24.060",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "security@tibco.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-06-27T19:15:14.937",
  "references": [
    {
      "source": "security@tibco.com",
      "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
    }
  ],
  "sourceIdentifier": "security@tibco.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-3330 (GCVE-0-2024-3330)

GHSA-65P7-VC93-6P69

WID-SEC-W-2024-1501

GSD-2024-3330

FKIE_CVE-2024-3330

Tags

Sightings

Nomenclature