Lucene search

[email protected]CVE-2019-8988

HistoryMar 26, 2019 - 6:29 p.m.

CVE-2019-8988

2019-03-2618:29:01

[email protected]

web.nvd.nist.gov

tibco

data science

aws

spotfire

cross-site vulnerability

privilege escalation

data modification

security advisory

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.6%

JSON

The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected system, in a way that may allow for data modifications and deletions that should be denied. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.

Affected configurations

NVD

Node

tibcodata_science_for_awsRange≤6.4.0

tibcospotfire_data_scienceRange≤6.4.0

CPENameOperatorVersion
tibco:data_science_for_awstibco data science for awsle6.4.0
tibco:spotfire_data_sciencetibco spotfire data sciencele6.4.0

CPE	Name	Operator	Version
tibco:data_science_for_aws	tibco data science for aws	le	6.4.0
tibco:spotfire_data_science	tibco spotfire data science	le	6.4.0

CNA Affected

[
  {
    "product": "TIBCO Data Science for AWS",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TIBCO Spotfire Data Science",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.securityfocus.com/bid/107593

www.tibco.com/services/support/advisories

www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8988

Social References

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.6%

JSON

Related for CVE-2019-8988

cvelist1 nvd1 prion1