CVE-2019-17337

Summary

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker to perform a reflected cross-site scripting (XSS) attack. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.

Affected Software

VendorProductVersion RangeStatus
TIBCO Software Inc.TIBCO Spotfire Analytics Platform for AWS Marketplace10.6.0affected
TIBCO Software Inc.TIBCO Spotfire Serverunspecified <= 7.11.7affected
TIBCO Software Inc.TIBCO Spotfire Server7.12.0affected
TIBCO Software Inc.TIBCO Spotfire Server7.13.0affected
TIBCO Software Inc.TIBCO Spotfire Server7.14.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.0.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.0.1affected
TIBCO Software Inc.TIBCO Spotfire Server10.1.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.2.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.2.1affected
TIBCO Software Inc.TIBCO Spotfire Server10.3.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.3.1affected
TIBCO Software Inc.TIBCO Spotfire Server10.3.2affected
TIBCO Software Inc.TIBCO Spotfire Server10.3.3affected
TIBCO Software Inc.TIBCO Spotfire Server10.3.4affected
TIBCO Software Inc.TIBCO Spotfire Server10.4.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.5.0affected
TIBCO Software Inc.TIBCO Spotfire Server10.6.0affected

Weaknesses

  • The impact of the vulnerability includes the theoretical possibility that an attacker could gain full administrative access to the web interface of the affected component.

ADP Enrichment

CVE Program Container

Additional References

References