CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2019-11211

CVSS 9.9v3.1pub. 2019-09-18upd. 2024-11-21

The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Tibco Enterprise Runtime For R

    APP
    Tibco
    ≤ 1.2.0

  • Tibco Spotfire Analytics Platform For Aws

    APP
    Tibco
    10.4.010.5.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
RCEContainer
CWE
References

Related vulnerabilities

CVE-2019-11210CRITICAL10.0PL ✓same product

RCE w TIBCO Enterprise Runtime for R i Spotfire Analytics Platform for AWS

CVE-2018-5435CRITICAL9.6PL ✓same product

RCE w komponentach klienckich TIBCO Spotfire

CVE-2021-23275HIGH8.8same product

The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, T...

CVE-2021-28830HIGH8.8same product

The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterpr...

CVE-2020-9408HIGH8.8same product

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace ...