title: TIBCO Spotfire Data Science Vulnerable to Persistent Cross-Site Scripting
description: The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site scripting vulnerability that theoretically allows an authenticated user to gain access to all the capabilities of the web interface available to more privileged users. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.
problem types: The impact of these multiple vulnerabilities includes the theoretical possibility that a malicious actor could gain more privileged access to the web server component.
affected:
{
product: TIBCO Data Science for AWS
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.4.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Spotfire Data Science
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 6.4.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.0
]
solutions: TIBCO has released updated versions of the affected systems which address these issues.
TIBCO Data Science for AWS versions 6.4.0 and below upgrade to version 6.4.1 or higher
TIBCO Spotfire Data Science versions 6.4.0 and below upgrade to version 6.4.1 or higher