Vulnerability in Tibco Enterprise Runtime For R
CVE-2019-11211
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.037 (89.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: 0.000
Affected products
- Tibco Enterprise Runtime For R
- Tibco Spotfire Analytics Platform For AWS — versions 10.4.0, 10.5.0
- Tibco Software Inc. Enterprise Runtime For R - Server Edition — versions 1.2.0 and below
- Tibco Software Inc. Spotfire Analytics Platform For AWS Marketplace — versions 10.4.0, 10.5.0
References
- www.tibco.com/services/support/advisories (Vendor Advisory)
- www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2… (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11211?
- CVE-2019-11211 is a critical-severity vulnerability in Tibco Enterprise Runtime For R. CVSS score: 9.9/10. Published 2019-09-18.
- How severe is CVE-2019-11211?
- Critical severity. CVSS v3 base score is 9.9 out of 10.