CVE:CVE-2017-3180
CNNVD:CNNVD-201701-875
TIBCO Spotfire Automation Services等都是美国TIBCO软件公司的产品。Spotfire Automation Services是一套运行自动分析的工具；Spotfire Professional是一款为各个方面的商业分析师和用户提供全面分析的平台。
多款TIBCO产品中存在多个跨站脚本漏洞，该漏洞源于程序没有正确的过滤用户提交的输入。远程攻击者可利用该漏洞在用户浏览器中执行任意的脚本代码，窃取基于cookie的身份验证凭证。以下产品和版本受到影响：TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2及之前版本；TIBCO Spotfire Analyst 7.5.0版本；TIBCO Spotfire Analyst 7.6.0版本；TIBCO Spotfire Analyst 7.7.0版本；TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2及之前版本； TIBCO Spotfire Automation Services 6.5.3及之前版本；TIBCO Spotfire Automation Services 7.0.0版本，7.0.1版本；TIBCO Spotfire Connectors 7.6.0版本；TIBCO Spotfire Deployment Kit 6.5.3及之前版本；TIBCO Spotfire Deployment Kit 7.0.0版本，7.0.1版本；TIBCO Spotfire Deployment Kit 7.5.0版本；TIBCO Spotfire Deployment Kit 7.6.0版本；TIBCO Spotfire Deployment Kit 7.7.0版本；TIBCO Spotfire Desktop 6.5.2及之前版本；TIBCO Spotfire Desktop 7.0.0版本，7.0.1版本；TIBCO Spotfire Desktop 7.5.0版本；TIBCO Spotfire Desktop 7.6.0版本；TIBCO Spotfire Desktop 7.7.0版本；TIBCO Spotfire Desktop Developer Edition 7.7.0版本；TIBCO Spotfire Desktop Language Packs 7.0.1及之前版本；TIBCO Spotfire Desktop Language Packs 7.5.0版本；TIBCO Spotfire Desktop Language Packs 7.6.0版本；TIBCO Spotfire Desktop Language Packs 7.7.0版本；TIBCO Spotfire Professional 6.5.3及之前版本；TIBCO Spotfire Professional 7.0.0版本，7.0.1版本；TIBCO Spotfire Web Player 6.5.3及之前版本；TIBCO Spotfire Web Player 7.0.0版本，7.0.1版本。
solution:Upgrade tibco silver_fabric_enabler_for_spotfire_web_player to a higher version than 2.1.2,and avoid the version (,2.1.2]; Upgrade tibco spotfire_analyst to a higher version than 7.5.0,7.6.0,7.7.0,and avoid the version 7.5.0,7.6.0,7.7.0; Upgrade tibco spotfire_analytics_platform_for_aws to a higher version than 7.0.2,and avoid the version (,7.0.2]; Upgrade tibco spotfire_automation_services to a higher version than 6.5.3,7.0.0,7.0.1,and avoid the version (,6.5.3],7.0.0,7.0.1; Upgrade tibco spotfire_connectors to a higher version than 7.6.0,and avoid the version 7.6.0; Upgrade tibco spotfire_deployment_kit to a higher version than 6.5.3,7.0.0,7.0.1,7.5.0,7.6.0,7.7.0,and avoid the version (,6.5.3],7.0.0,7.0.1,7.5.0,7.6.0,7.7.0; Upgrade tibco spotfire_desktop to a higher version than 6.5.2,7.0.0,7.0.1,7.5.0,7.6.0,7.7.0,and avoid the version (,6.5.2],7.0.0,7.0.1,7.5.0,7.6.0,7.7.0; Upgrade tibco spotfire_desktop_language_packs to a higher version than 7.0.1,7.5.0,7.6.0,7.7.0,and avoid the version (,7.0.1],7.5.0,7.6.0,7.7.0; Upgrade tibco spotfire_professional to a higher version than 6.5.3,7.0.0,7.0.1,and avoid the version (,6.5.3],7.0.0,7.0.1; Upgrade tibco spotfire_web_player to a higher version than 6.5.3,7.0.0,7.0.1,and avoid the version (,6.5.3],7.0.0,7.0.1