title: TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability
description: The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.
problem types: The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.
affected:
{
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 10.8.0, status: affected, version: unspecified, versionType: custom
}
{
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
versions:
lessThanOrEqual: 7.11.9, status: affected, version: unspecified, versionType: custom
status: affected, version: 7.12.0
status: affected, version: 7.13.0
status: affected, version: 7.14.0
status: affected, version: 10.0.0
status: affected, version: 10.0.1
status: affected, version: 10.1.0
status: affected, version: 10.2.0
status: affected, version: 10.3.0
status: affected, version: 10.3.1
status: affected, version: 10.3.2
status: affected, version: 10.3.3
status: affected, version: 10.3.4
status: affected, version: 10.3.5
status: affected, version: 10.3.6
status: affected, version: 10.4.0
status: affected, version: 10.5.0
status: affected, version: 10.6.0
status: affected, version: 10.6.1
status: affected, version: 10.7.0
status: affected, version: 10.8.0
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.0
]
solutions: TIBCO has released updated versions of the affected components which address these issues.
TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below update to version 10.8.1 or higher
TIBCO Spotfire Server versions 7.11.9 and below update to version 7.11.10 or higher
TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6 update to version 10.3.7 or higher
TIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0 update to version 10.8.1 or higher