The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HTibco Analytics Platform
APPTibco≤ 11.1.0Tibco Spotfire Analyst
APPTibco10.10.010.10.110.10.210.7.010.8.010.9.011.0.011.1.0≤ 10.3.3Tibco Spotfire Desktop
APPTibco10.10.010.10.110.10.210.7.010.8.010.9.011.0.011.1.0≤ 10.3.3Tibco Spotfire Server
APPTibco10.10.010.10.110.10.210.10.310.7.010.8.010.8.110.9.011.0.011.1.0≤ 10.3.11
Powiązane podatności
RCE w Tibco Spotfire — wstrzyknięcie kodu i nievalidowane nazwy plików
Stored XSS w komponencie Visualizations TIBCO Spotfire
SQL Injection w wielu produktach TIBCO Spotfire (CVE-2017-3181)
RCE w komponentach klienckich TIBCO Spotfire
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TI...