cnvd - cnvd-2020-19557

CNVD-2020-19557

Vulnerability from cnvd - Published: 2020-03-26

Title

TIBCO Software Spotfire Analytics Platform for AWS Marketplace和TIBCO Spotfire Server远程代码执行漏洞

Description

TIBCO Software Spotfire Analytics Platform for AWS Marketplace和TIBCO Spotfire Server都是美国TIBCO Software公司的产品。TIBCO Software Spotfire Analytics Platform for AWS Marketplace是一套为云应用商店AWS提供数据可视化分析的平台。TIBCO Spotfire Server是一套基于TIBCO Spotfire（数据分析和挖掘工具）的为企业提供整合、运行和管理的平台。 TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace和TIBCO Spotfire Server中的Spotfire library组件存在远程代码执行漏洞，攻击者可利用该漏洞以系统账户权限执行代码。

Severity

高

Patch Name

TIBCO Software Spotfire Analytics Platform for AWS Marketplace和TIBCO Spotfire Server远程代码执行漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-9408

Impacted products

Name
['TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace <=10.8.0', 'TIBCO Software TIBCO Spotfire Server <=7.11.9', 'TIBCO Software TIBCO Spotfire Server 7.12.0', 'TIBCO Software TIBCO Spotfire Server 7.13.0', 'TIBCO Software TIBCO Spotfire Server 7.14.0', 'TIBCO Software TIBCO Spotfire Server 10.0.0', 'TIBCO Software TIBCO Spotfire Server 10.0.1', 'TIBCO Software TIBCO Spotfire Server 10.1.0', 'TIBCO Software TIBCO Spotfire Server 10.2.0', 'TIBCO Software TIBCO Spotfire Server 10.3.0', 'TIBCO Software TIBCO Spotfire Server 10.3.1', 'TIBCO Software TIBCO Spotfire Server 10.3.2', 'TIBCO Software TIBCO Spotfire Server 10.3.3', 'TIBCO Software TIBCO Spotfire Server 10.3.4', 'TIBCO Software TIBCO Spotfire Server 10.3.5', 'TIBCO Software TIBCO Spotfire Server 10.3.6', 'TIBCO Software TIBCO Spotfire Server 10.4.0', 'TIBCO Software TIBCO Spotfire Server 10.5.0', 'TIBCO Software TIBCO Spotfire Server 10.6.0', 'TIBCO Software TIBCO Spotfire Server 10.6.1', 'TIBCO Software TIBCO Spotfire Server 10.7.0', 'TIBCO Software TIBCO Spotfire Server 10.8.0']

Name

['TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace <=10.8.0', 'TIBCO Software TIBCO Spotfire Server <=7.11.9', 'TIBCO Software TIBCO Spotfire Server 7.12.0', 'TIBCO Software TIBCO Spotfire Server 7.13.0', 'TIBCO Software TIBCO Spotfire Server 7.14.0', 'TIBCO Software TIBCO Spotfire Server 10.0.0', 'TIBCO Software TIBCO Spotfire Server 10.0.1', 'TIBCO Software TIBCO Spotfire Server 10.1.0', 'TIBCO Software TIBCO Spotfire Server 10.2.0', 'TIBCO Software TIBCO Spotfire Server 10.3.0', 'TIBCO Software TIBCO Spotfire Server 10.3.1', 'TIBCO Software TIBCO Spotfire Server 10.3.2', 'TIBCO Software TIBCO Spotfire Server 10.3.3', 'TIBCO Software TIBCO Spotfire Server 10.3.4', 'TIBCO Software TIBCO Spotfire Server 10.3.5', 'TIBCO Software TIBCO Spotfire Server 10.3.6', 'TIBCO Software TIBCO Spotfire Server 10.4.0', 'TIBCO Software TIBCO Spotfire Server 10.5.0', 'TIBCO Software TIBCO Spotfire Server 10.6.0', 'TIBCO Software TIBCO Spotfire Server 10.6.1', 'TIBCO Software TIBCO Spotfire Server 10.7.0', 'TIBCO Software TIBCO Spotfire Server 10.8.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9408"
    }
  },
  "description": "TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u90fd\u662f\u7f8e\u56fdTIBCO Software\u516c\u53f8\u7684\u4ea7\u54c1\u3002TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u662f\u4e00\u5957\u4e3a\u4e91\u5e94\u7528\u5546\u5e97AWS\u63d0\u4f9b\u6570\u636e\u53ef\u89c6\u5316\u5206\u6790\u7684\u5e73\u53f0\u3002TIBCO Spotfire Server\u662f\u4e00\u5957\u57fa\u4e8eTIBCO Spotfire\uff08\u6570\u636e\u5206\u6790\u548c\u6316\u6398\u5de5\u5177\uff09\u7684\u4e3a\u4f01\u4e1a\u63d0\u4f9b\u6574\u5408\u3001\u8fd0\u884c\u548c\u7ba1\u7406\u7684\u5e73\u53f0\u3002\n\nTIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u4e2d\u7684Spotfire library\u7ec4\u4ef6\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7cfb\u7edf\u8d26\u6237\u6743\u9650\u6267\u884c\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-19557",
  "openTime": "2020-03-26",
  "patchDescription": "TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u90fd\u662f\u7f8e\u56fdTIBCO Software\u516c\u53f8\u7684\u4ea7\u54c1\u3002TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u662f\u4e00\u5957\u4e3a\u4e91\u5e94\u7528\u5546\u5e97AWS\u63d0\u4f9b\u6570\u636e\u53ef\u89c6\u5316\u5206\u6790\u7684\u5e73\u53f0\u3002TIBCO Spotfire Server\u662f\u4e00\u5957\u57fa\u4e8eTIBCO Spotfire\uff08\u6570\u636e\u5206\u6790\u548c\u6316\u6398\u5de5\u5177\uff09\u7684\u4e3a\u4f01\u4e1a\u63d0\u4f9b\u6574\u5408\u3001\u8fd0\u884c\u548c\u7ba1\u7406\u7684\u5e73\u53f0\u3002\r\n\r\nTIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u4e2d\u7684Spotfire library\u7ec4\u4ef6\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u7cfb\u7edf\u8d26\u6237\u6743\u9650\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "TIBCO Software TIBCO Spotfire Analytics Platform for AWS Marketplace \u003c=10.8.0",
      "TIBCO Software TIBCO Spotfire Server  \u003c=7.11.9",
      "TIBCO Software TIBCO Spotfire Server  7.12.0",
      "TIBCO Software TIBCO Spotfire Server  7.13.0",
      "TIBCO Software TIBCO Spotfire Server  7.14.0",
      "TIBCO Software TIBCO Spotfire Server  10.0.0",
      "TIBCO Software TIBCO Spotfire Server  10.0.1",
      "TIBCO Software TIBCO Spotfire Server  10.1.0",
      "TIBCO Software TIBCO Spotfire Server  10.2.0",
      "TIBCO Software TIBCO Spotfire Server  10.3.0",
      "TIBCO Software TIBCO Spotfire Server  10.3.1",
      "TIBCO Software TIBCO Spotfire Server  10.3.2",
      "TIBCO Software TIBCO Spotfire Server  10.3.3",
      "TIBCO Software TIBCO Spotfire Server  10.3.4",
      "TIBCO Software TIBCO Spotfire Server  10.3.5",
      "TIBCO Software TIBCO Spotfire Server  10.3.6",
      "TIBCO Software TIBCO Spotfire Server  10.4.0",
      "TIBCO Software TIBCO Spotfire Server  10.5.0",
      "TIBCO Software TIBCO Spotfire Server  10.6.0",
      "TIBCO Software TIBCO Spotfire Server  10.6.1",
      "TIBCO Software TIBCO Spotfire Server  10.7.0",
      "TIBCO Software TIBCO Spotfire Server  10.8.0"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9408",
  "serverity": "\u9ad8",
  "submitTime": "2020-03-12",
  "title": "TIBCO Software Spotfire Analytics Platform for AWS Marketplace\u548cTIBCO Spotfire Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2020-9408 (GCVE-0-2020-9408)

Vulnerability from cvelistv5 – Published: 2020-03-11 19:55 – Updated: 2024-09-16 22:30

Summary

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.

Severity ?

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.

Assigner

tibco

References

URL

Tags

	http://www.tibco.com/services/support/advisories	x_refsource_CONFIRM
	https://www.tibco.com/support/advisories/2020/03/…	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

TIBCO Software Inc.

TIBCO Spotfire Analytics Platform for AWS Marketplace

Affected: unspecified , ≤ 10.8.0 (custom)

TIBCO Software Inc.

TIBCO Spotfire Server

Affected: unspecified , ≤ 7.11.9 (custom)
Affected: 7.12.0
Affected: 7.13.0
Affected: 7.14.0
Affected: 10.0.0
Affected: 10.0.1
Affected: 10.1.0
Affected: 10.2.0
Affected: 10.3.0
Affected: 10.3.1
Affected: 10.3.2
Affected: 10.3.3
Affected: 10.3.4
Affected: 10.3.5
Affected: 10.3.6
Affected: 10.4.0
Affected: 10.5.0
Affected: 10.6.0
Affected: 10.6.1
Affected: 10.7.0
Affected: 10.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:26:16.100Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.tibco.com/services/support/advisories"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "10.8.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO Spotfire Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.11.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.12.0"
            },
            {
              "status": "affected",
              "version": "7.13.0"
            },
            {
              "status": "affected",
              "version": "7.14.0"
            },
            {
              "status": "affected",
              "version": "10.0.0"
            },
            {
              "status": "affected",
              "version": "10.0.1"
            },
            {
              "status": "affected",
              "version": "10.1.0"
            },
            {
              "status": "affected",
              "version": "10.2.0"
            },
            {
              "status": "affected",
              "version": "10.3.0"
            },
            {
              "status": "affected",
              "version": "10.3.1"
            },
            {
              "status": "affected",
              "version": "10.3.2"
            },
            {
              "status": "affected",
              "version": "10.3.3"
            },
            {
              "status": "affected",
              "version": "10.3.4"
            },
            {
              "status": "affected",
              "version": "10.3.5"
            },
            {
              "status": "affected",
              "version": "10.3.6"
            },
            {
              "status": "affected",
              "version": "10.4.0"
            },
            {
              "status": "affected",
              "version": "10.5.0"
            },
            {
              "status": "affected",
              "version": "10.6.0"
            },
            {
              "status": "affected",
              "version": "10.6.1"
            },
            {
              "status": "affected",
              "version": "10.7.0"
            },
            {
              "status": "affected",
              "version": "10.8.0"
            }
          ]
        }
      ],
      "datePublic": "2020-03-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-03-11T19:55:12",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.tibco.com/services/support/advisories"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2020-03-11T17:00:00Z",
          "ID": "CVE-2020-9408",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "10.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Spotfire Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.11.9"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.12.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.13.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.14.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.0.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.1.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.2.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.5"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.3.6"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.4.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.5.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.6.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.6.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.7.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "10.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Spotfire library component of TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not \"Script Author\" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.tibco.com/services/support/advisories",
              "refsource": "CONFIRM",
              "url": "http://www.tibco.com/services/support/advisories"
            },
            {
              "name": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher\nTIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher\nTIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher\nTIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2020-9408",
    "datePublished": "2020-03-11T19:55:12.878877Z",
    "dateReserved": "2020-02-26T00:00:00",
    "dateUpdated": "2024-09-16T22:30:59.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-19557

CVE-2020-9408 (GCVE-0-2020-9408)

Tags

Sightings

Nomenclature