title: TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks
description: The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0.
problem types: The impact of this vulnerability includes the theoretical possibility that an unauthenticated attacker could remove comments from the system, rename bookmarks, and trick other users about which user authored a comment.
affected:
{
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 10.2.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 7.11.2, status: affected, version: unspecified, versionType: custom
status: affected, version: 7.12.0
status: affected, version: 7.13.0
status: affected, version: 7.14.0
status: affected, version: 10.0.0
status: affected, version: 10.0.1
status: affected, version: 10.1.0
status: affected, version: 10.2.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.2.0 and below update to 10.3.0 or higher
TIBCO Spotfire Server versions 7.11.2 and below update to 7.11.3 or higher
TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, and 10.2.0 update to 10.2.1 or higher