title: TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability
description: The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.
problem types: Uploaded or modified files may be executed within the scope of the web server process allowing access to the system.
affected:
{
defaultStatus: unknown
product: TIBCO Spotfire Statistics Services
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 11.4.10, status: affected, version: 0, versionType: semver
status: affected, version: 11.5.0
status: affected, version: 11.6.0
status: affected, version: 11.6.1
status: affected, version: 11.6.2
status: affected, version: 11.7.0
status: affected, version: 11.8.0
status: affected, version: 11.8.1
status: affected, version: 12.0.0
status: affected, version: 12.0.1
status: affected, version: 12.0.2
status: affected, version: 12.1.0
status: affected, version: 12.2.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Spotfire Statistics Services versions 11.4.10 and below: update to version 11.4.11 or later
TIBCO Spotfire Statistics Services versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2: update to version 12.0.3 or later
TIBCO Spotfire Statistics Services versions 12.1.0 and 12.2.0: update to version 12.3.0 or later