Vulnerability in Tibco Enterprise Runtime For R
CVE-2019-11211
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.
EPSS: 0.037 (88.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Tibco Enterprise_runtime_for_r
- Tibco Spotfire_analytics_platform_for_aws — versions 10.4.0, 10.5.0
- Tibco Software Inc. Enterprise Runtime For R - Server Edition — versions 1.2.0 and below
- Tibco Software Inc. Spotfire Analytics Platform For Aws Marketplace — versions 10.4.0, 10.5.0
References
- security@tibco.com (x_refsource_MISC, Vendor Advisory)
- security@tibco.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11211?
- CVE-2019-11211 is a critical-severity vulnerability in Tibco Enterprise Runtime For R. CVSS score: 9.9/10. Published 2019-09-18.
- How severe is CVE-2019-11211?
- Critical severity. CVSS v3 base score is 9.9 out of 10.