Vulnerability in Tibco Spotfire Analytics Platform For AWS
CVE-2019-17335
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.008 (54.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Tibco Spotfire Analytics Platform For AWS — versions 10.6.0
- Tibco Spotfire Server — versions 7.12.0, 7.13.0, 7.14.0
- Tibco Software Inc. Spotfire Analytics Platform For AWS Marketplace — versions 10.6.0
- Tibco Software Inc. Spotfire Server — versions unspecified, 7.12.0, 7.13.0
References
- www.tibco.com/services/support/advisories (Vendor Advisory)
- www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-20… (Vendor Advisory)
Frequently asked questions
- What is CVE-2019-17335?
- CVE-2019-17335 is a medium-severity vulnerability in Tibco Spotfire Analytics Platform For AWS. CVSS score: 6.5/10. Published 2019-12-17.
- How severe is CVE-2019-17335?
- Medium severity. CVSS v3 base score is 6.5 out of 10.