Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Spotfire for AWS Marketplace by Spotfire
CVE-2025-3115 (GCVE-0-2025-3115)
Vulnerability from nvd – Published: 2025-04-09 18:12 – Updated: 2025-11-11 11:47
VLAI
Title
Spotfire Data Function Vulnerability
Summary
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.
Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Statistics Services |
Affected:
14 , < 14.0.7
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Analyst |
Affected:
14.0 , < 14.0.6
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Deployment Kit used in Spotfire Server |
Affected:
14.0 , < 14.0.7
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Desktop |
Affected:
14.4 , < 14.4.2
(Patch)
|
|
| Spotfire | Spotfire for AWS Marketplace |
Unknown:
14.4 , < 14.4.2
(Patch)
|
|
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 (Patch) Affected: 1.19.0 (Patch) Affected: 1.20.0 (Patch) Affected: 1.21.0 (Patch) Affected: 1.21.1 (Patch) |
|
| Spotfire | Spotfire Service for Python |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 , ≤ 1.21.1 (Patch) |
|
| Spotfire | Spotfire Service for R |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 , ≤ 1.21.1 (Patch) |
Date Public
2025-04-08 16:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T18:28:35.698097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T18:29:39.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Statistics Services",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.7",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.6",
"status": "affected",
"version": "14.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Deployment Kit used in Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.7",
"status": "affected",
"version": "14.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Desktop",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.4.2",
"status": "affected",
"version": "14.4",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.4.2",
"status": "unknown",
"version": "14.4",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Enterprise Runtime for R - Server Edition",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.19.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.20.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Service for Python",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"lessThanOrEqual": "1.21.1",
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Service for R",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"lessThanOrEqual": "1.21.1",
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
}
]
}
],
"datePublic": "2025-04-08T16:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\n\n\u003cstrong\u003eInjection Vulnerabilities: \u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAttackers can inject malicious code, potentially gaining control over the system executing these functions.\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAdditionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution\u003c/span\u003e\n\n\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.\nAdditionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-11T11:47:58.064Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Data Function Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2025-3115",
"datePublished": "2025-04-09T18:12:28.348Z",
"dateReserved": "2025-04-02T10:56:03.148Z",
"dateUpdated": "2025-11-11T11:47:58.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3114 (GCVE-0-2025-3114)
Vulnerability from nvd – Published: 2025-04-09 17:29 – Updated: 2025-04-15 20:29
VLAI
Title
Spotfire Code Execution Vulnerability
Summary
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.
Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Enterprise Runtime for R |
Affected:
6 , ≤ 1.4
(Patch)
|
|
| Spotfire | Spotfire Statistics Services |
Affected:
14 , ≤ 0.6
(Patch)
Affected: 14.1.0 Affected: 14.2.0 Affected: 14.3.0 Affected: 14.4.0 Affected: 14.4.1 |
|
| Spotfire | Spotfire Analyst |
Affected:
14 , ≤ 0.5
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Deployment Kit used in Spotfire Server |
Affected:
14 , ≤ 0.6
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Desktop |
Affected:
14 , ≤ 4.1
(Patch)
|
|
| Spotfire | Spotfire for AWS Marketplace |
Unknown:
14 , ≤ 4.1
(Patch)
|
|
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition |
Affected:
1 , ≤ 17.6
(Patch)
Affected: 1.18.0 (Patch) Affected: 1.19.0 (Patch) Affected: 1.20.0 (Patch) Affected: 1.21.0 (Patch) Affected: 1.21.1 (Patch) |
Date Public
2025-04-08 16:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T18:03:07.615805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T20:29:11.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Enterprise Runtime for R",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "1.4",
"status": "affected",
"version": "6",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Statistics Services",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.6",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
},
{
"status": "affected",
"version": "14.4.0"
},
{
"status": "affected",
"version": "14.4.1"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.5",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Deployment Kit used in Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.6",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Desktop",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "4.1",
"status": "affected",
"version": "14",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "4.1",
"status": "unknown",
"version": "14",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Enterprise Runtime for R - Server Edition",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "17.6",
"status": "affected",
"version": "1",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.19.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.20.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.1",
"versionType": "Patch"
}
]
}
],
"datePublic": "2025-04-08T16:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eCode Execution via Malicious Files:\u003c/strong\u003e\u0026nbsp;Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSandbox Bypass Vulnerability:\u003c/strong\u003e\u0026nbsp;A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.\u003c/p\u003e"
}
],
"value": "Code Execution via Malicious Files:\u00a0Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability:\u00a0A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T17:29:48.612Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Code Execution Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2025-3114",
"datePublished": "2025-04-09T17:29:48.612Z",
"dateReserved": "2025-04-02T10:55:41.023Z",
"dateUpdated": "2025-04-15T20:29:11.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-3330 (GCVE-0-2024-3330)
Vulnerability from nvd – Published: 2024-06-27 18:37 – Updated: 2024-08-01 20:05
VLAI
Title
Spotfire Remote Code Execution Vulnerability
Summary
Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Analyst |
Affected:
12.0.9 , ≤ 12.5.0
(patch)
Affected: 14.0 , ≤ 14.0.2 (patch) |
|
| Spotfire | Spotfire Server |
Affected:
12.0.10 , ≤ 12.5.0
(patch)
Affected: 14.0 , ≤ 14.0.3 (patch) Affected: 14.2.0 , ≤ 14.3.0 (patch) |
|
| Spotfire | Spotfire for AWS Marketplace |
Affected:
14.0 , < 14.3.0
(patch)
|
|
| tibco | spotfire_analyst |
Affected:
12.1.0
Affected: 12.1.1 Affected: 12.2.0 Affected: 12.3.0 Affected: 12.4.0 Affected: 12.5.0 Affected: 14.0.0 Affected: 14.0.1 Affected: 14.0.2 Affected: 14.1.0 Affected: 14.2.0 Affected: 14.3.0 cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:* |
|
| tibco | spotfire_server |
Affected:
12.1.0
Affected: 12.1.1 Affected: 12.2.0 Affected: 12.3.0 Affected: 12.4.0 Affected: 12.5.0 Affected: 14.0.0 Affected: 14.0.1 Affected: 14.0.2 Affected: 14.0.3 Affected: 14.2.0 Affected: 14.3.0 cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:* |
|
| tibco | spotfire_analytics_platform_for_aws |
Affected:
0 , ≤ 14.3.0
(custom)
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:* |
|
| tibco | spotfire_analyst |
Affected:
0 , ≤ 12.0.9
(custom)
cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:* |
|
| tibco | spotfire_server |
Affected:
0 , ≤ 12.0.10
(custom)
cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* |
Date Public
2024-06-26 06:30
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analyst",
"vendor": "tibco",
"versions": [
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.2.0"
},
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
},
{
"status": "affected",
"version": "14.0.0"
},
{
"status": "affected",
"version": "14.0.1"
},
{
"status": "affected",
"version": "14.0.2"
},
{
"status": "affected",
"version": "14.1.0"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_server",
"vendor": "tibco",
"versions": [
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.2.0"
},
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
},
{
"status": "affected",
"version": "14.0.0"
},
{
"status": "affected",
"version": "14.0.1"
},
{
"status": "affected",
"version": "14.0.2"
},
{
"status": "affected",
"version": "14.0.3"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analytics_platform_for_aws",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "14.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analyst",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "12.0.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_server",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-02T19:33:08.056282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T20:02:22.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:05:08.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "12.5.0",
"status": "affected",
"version": "12.0.9",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.0.2",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "12.5.0",
"status": "affected",
"version": "12.0.10",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.0.3",
"status": "affected",
"version": "14.0",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.3.0",
"status": "affected",
"version": "14.2.0",
"versionType": "patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.3.0",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
}
],
"datePublic": "2024-06-26T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..\u003cp\u003eThis issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T18:37:34.119Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/b\u003e"
}
],
"value": "* Spotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\n\n\n * Spotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\n\n\n * Spotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n * Spotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\n\n\n * Spotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\n\n\n * Spotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n * Spotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Remote Code Execution Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2024-3330",
"datePublished": "2024-06-27T18:37:34.119Z",
"dateReserved": "2024-04-04T17:01:54.246Z",
"dateUpdated": "2024-08-01T20:05:08.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3115 (GCVE-0-2025-3115)
Vulnerability from cvelistv5 – Published: 2025-04-09 18:12 – Updated: 2025-11-11 11:47
VLAI
Title
Spotfire Data Function Vulnerability
Summary
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.
Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Statistics Services |
Affected:
14 , < 14.0.7
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Analyst |
Affected:
14.0 , < 14.0.6
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Deployment Kit used in Spotfire Server |
Affected:
14.0 , < 14.0.7
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Desktop |
Affected:
14.4 , < 14.4.2
(Patch)
|
|
| Spotfire | Spotfire for AWS Marketplace |
Unknown:
14.4 , < 14.4.2
(Patch)
|
|
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 (Patch) Affected: 1.19.0 (Patch) Affected: 1.20.0 (Patch) Affected: 1.21.0 (Patch) Affected: 1.21.1 (Patch) |
|
| Spotfire | Spotfire Service for Python |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 , ≤ 1.21.1 (Patch) |
|
| Spotfire | Spotfire Service for R |
Affected:
1.17 , < 1.17.7
(Patch)
Affected: 1.18.0 , ≤ 1.21.1 (Patch) |
Date Public
2025-04-08 16:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T18:28:35.698097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T18:29:39.691Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Statistics Services",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.7",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.6",
"status": "affected",
"version": "14.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Deployment Kit used in Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.0.7",
"status": "affected",
"version": "14.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Desktop",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.4.2",
"status": "affected",
"version": "14.4",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.4.2",
"status": "unknown",
"version": "14.4",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Enterprise Runtime for R - Server Edition",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.19.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.20.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Service for Python",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"lessThanOrEqual": "1.21.1",
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Service for R",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "1.17.7",
"status": "affected",
"version": "1.17",
"versionType": "Patch"
},
{
"lessThanOrEqual": "1.21.1",
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
}
]
}
],
"datePublic": "2025-04-08T16:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\n\n\u003cstrong\u003eInjection Vulnerabilities: \u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAttackers can inject malicious code, potentially gaining control over the system executing these functions.\u003c/span\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAdditionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution\u003c/span\u003e\n\n\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.\nAdditionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-11T11:47:58.064Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Data Function Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2025-3115",
"datePublished": "2025-04-09T18:12:28.348Z",
"dateReserved": "2025-04-02T10:56:03.148Z",
"dateUpdated": "2025-11-11T11:47:58.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3114 (GCVE-0-2025-3114)
Vulnerability from cvelistv5 – Published: 2025-04-09 17:29 – Updated: 2025-04-15 20:29
VLAI
Title
Spotfire Code Execution Vulnerability
Summary
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.
Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Enterprise Runtime for R |
Affected:
6 , ≤ 1.4
(Patch)
|
|
| Spotfire | Spotfire Statistics Services |
Affected:
14 , ≤ 0.6
(Patch)
Affected: 14.1.0 Affected: 14.2.0 Affected: 14.3.0 Affected: 14.4.0 Affected: 14.4.1 |
|
| Spotfire | Spotfire Analyst |
Affected:
14 , ≤ 0.5
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Deployment Kit used in Spotfire Server |
Affected:
14 , ≤ 0.6
(Patch)
Affected: 14.1.0 (Patch) Affected: 14.2.0 (Patch) Affected: 14.3.0 (Patch) Affected: 14.4.0 (Patch) Affected: 14.4.1 (Patch) |
|
| Spotfire | Spotfire Desktop |
Affected:
14 , ≤ 4.1
(Patch)
|
|
| Spotfire | Spotfire for AWS Marketplace |
Unknown:
14 , ≤ 4.1
(Patch)
|
|
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition |
Affected:
1 , ≤ 17.6
(Patch)
Affected: 1.18.0 (Patch) Affected: 1.19.0 (Patch) Affected: 1.20.0 (Patch) Affected: 1.21.0 (Patch) Affected: 1.21.1 (Patch) |
Date Public
2025-04-08 16:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-09T18:03:07.615805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T20:29:11.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Enterprise Runtime for R",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "1.4",
"status": "affected",
"version": "6",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Statistics Services",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.6",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
},
{
"status": "affected",
"version": "14.4.0"
},
{
"status": "affected",
"version": "14.4.1"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.5",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Deployment Kit used in Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "0.6",
"status": "affected",
"version": "14",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.1.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.2.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.3.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "14.4.1",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Desktop",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "4.1",
"status": "affected",
"version": "14",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "4.1",
"status": "unknown",
"version": "14",
"versionType": "Patch"
}
]
},
{
"defaultStatus": "unknown",
"product": "Spotfire Enterprise Runtime for R - Server Edition",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "17.6",
"status": "affected",
"version": "1",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.18.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.19.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.20.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.0",
"versionType": "Patch"
},
{
"status": "affected",
"version": "1.21.1",
"versionType": "Patch"
}
]
}
],
"datePublic": "2025-04-08T16:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eCode Execution via Malicious Files:\u003c/strong\u003e\u0026nbsp;Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eSandbox Bypass Vulnerability:\u003c/strong\u003e\u0026nbsp;A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.\u003c/p\u003e"
}
],
"value": "Code Execution via Malicious Files:\u00a0Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability:\u00a0A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-09T17:29:48.612Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Code Execution Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2025-3114",
"datePublished": "2025-04-09T17:29:48.612Z",
"dateReserved": "2025-04-02T10:55:41.023Z",
"dateUpdated": "2025-04-15T20:29:11.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-3330 (GCVE-0-2024-3330)
Vulnerability from cvelistv5 – Published: 2024-06-27 18:37 – Updated: 2024-08-01 20:05
VLAI
Title
Spotfire Remote Code Execution Vulnerability
Summary
Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Spotfire | Spotfire Analyst |
Affected:
12.0.9 , ≤ 12.5.0
(patch)
Affected: 14.0 , ≤ 14.0.2 (patch) |
|
| Spotfire | Spotfire Server |
Affected:
12.0.10 , ≤ 12.5.0
(patch)
Affected: 14.0 , ≤ 14.0.3 (patch) Affected: 14.2.0 , ≤ 14.3.0 (patch) |
|
| Spotfire | Spotfire for AWS Marketplace |
Affected:
14.0 , < 14.3.0
(patch)
|
|
| tibco | spotfire_analyst |
Affected:
12.1.0
Affected: 12.1.1 Affected: 12.2.0 Affected: 12.3.0 Affected: 12.4.0 Affected: 12.5.0 Affected: 14.0.0 Affected: 14.0.1 Affected: 14.0.2 Affected: 14.1.0 Affected: 14.2.0 Affected: 14.3.0 cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:* |
|
| tibco | spotfire_server |
Affected:
12.1.0
Affected: 12.1.1 Affected: 12.2.0 Affected: 12.3.0 Affected: 12.4.0 Affected: 12.5.0 Affected: 14.0.0 Affected: 14.0.1 Affected: 14.0.2 Affected: 14.0.3 Affected: 14.2.0 Affected: 14.3.0 cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:* |
|
| tibco | spotfire_analytics_platform_for_aws |
Affected:
0 , ≤ 14.3.0
(custom)
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:* |
|
| tibco | spotfire_analyst |
Affected:
0 , ≤ 12.0.9
(custom)
cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:* |
|
| tibco | spotfire_server |
Affected:
0 , ≤ 12.0.10
(custom)
cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* |
Date Public
2024-06-26 06:30
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analyst",
"vendor": "tibco",
"versions": [
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.2.0"
},
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
},
{
"status": "affected",
"version": "14.0.0"
},
{
"status": "affected",
"version": "14.0.1"
},
{
"status": "affected",
"version": "14.0.2"
},
{
"status": "affected",
"version": "14.1.0"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_server",
"vendor": "tibco",
"versions": [
{
"status": "affected",
"version": "12.1.0"
},
{
"status": "affected",
"version": "12.1.1"
},
{
"status": "affected",
"version": "12.2.0"
},
{
"status": "affected",
"version": "12.3.0"
},
{
"status": "affected",
"version": "12.4.0"
},
{
"status": "affected",
"version": "12.5.0"
},
{
"status": "affected",
"version": "14.0.0"
},
{
"status": "affected",
"version": "14.0.1"
},
{
"status": "affected",
"version": "14.0.2"
},
{
"status": "affected",
"version": "14.0.3"
},
{
"status": "affected",
"version": "14.2.0"
},
{
"status": "affected",
"version": "14.3.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analytics_platform_for_aws",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "14.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_analyst",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "12.0.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "spotfire_server",
"vendor": "tibco",
"versions": [
{
"lessThanOrEqual": "12.0.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-02T19:33:08.056282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T20:02:22.998Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:05:08.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spotfire Analyst",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "12.5.0",
"status": "affected",
"version": "12.0.9",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.0.2",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire Server",
"vendor": "Spotfire",
"versions": [
{
"lessThanOrEqual": "12.5.0",
"status": "affected",
"version": "12.0.10",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.0.3",
"status": "affected",
"version": "14.0",
"versionType": "patch"
},
{
"lessThanOrEqual": "14.3.0",
"status": "affected",
"version": "14.2.0",
"versionType": "patch"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Spotfire for AWS Marketplace",
"vendor": "Spotfire",
"versions": [
{
"lessThan": "14.3.0",
"status": "affected",
"version": "14.0",
"versionType": "patch"
}
]
}
],
"datePublic": "2024-06-26T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..\u003cp\u003eThis issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process"
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T18:37:34.119Z",
"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"shortName": "tibco"
},
"references": [
{
"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan style=\"background-color: rgb(254, 254, 254);\"\u003eSpotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/b\u003e"
}
],
"value": "* Spotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher\n\n\n * Spotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher\n\n\n * Spotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n * Spotfire Server 12.0.10 and earlier: upgrade to version 12.0.11\n\n\n * Spotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher\n\n\n * Spotfire Server 14.2.0, 14.3.0: upgrade to version 14.4.0\n\n\n * Spotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spotfire Remote Code Execution Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
"assignerShortName": "tibco",
"cveId": "CVE-2024-3330",
"datePublished": "2024-06-27T18:37:34.119Z",
"dateReserved": "2024-04-04T17:01:54.246Z",
"dateUpdated": "2024-08-01T20:05:08.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}