title: TIBCO Spotfire Insufficiently Protected Credential vulnerability
description: The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.
problem types: CWE-522 Insufficiently Protected Credentials
affected:
{
defaultStatus: unknown
product: Spotfire Analyst
vendor: TIBCO Software Inc.
versions:
status: affected, version: 12.3.0
status: affected, version: 12.4.0
status: affected, version: 12.5.0
}
{
defaultStatus: unknown
product: Spotfire Server
vendor: TIBCO Software Inc.
versions:
status: affected, version: 12.3.0
status: affected, version: 12.4.0
status: affected, version: 12.5.0
}
{
defaultStatus: unknown
product: Spotfire for AWS Marketplace
vendor: TIBCO Software Inc.
versions:
status: affected, version: 12.5.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
Spotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later
Spotfire Server versions 12.3.0, 12.4.0, and 12.5.0: update to version 14.0.0 or later
Spotfire for AWS Marketplace version 12.5.0: update to version 14.0.0 or later