Lucene search

TibcoCVELIST:CVE-2021-23273

HistoryMar 09, 2021 - 8:35 p.m.

CVE-2021-23273 TIBCO Spotfire Cross Site Scripting Vulnerability

2021-03-0920:35:16

tibco

www.cve.org

tibco spotfire

cross site scripting

vulnerability

low privileged attacker

stored xss

aws marketplace

network access

affected releases

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.

CNA Affected

[
  {
    "product": "TIBCO Spotfire Analyst",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "10.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.10.0"
      },
      {
        "status": "affected",
        "version": "10.10.1"
      },
      {
        "status": "affected",
        "version": "10.10.2"
      },
      {
        "status": "affected",
        "version": "10.7.0"
      },
      {
        "status": "affected",
        "version": "10.8.0"
      },
      {
        "status": "affected",
        "version": "10.9.0"
      },
      {
        "status": "affected",
        "version": "11.0.0"
      },
      {
        "status": "affected",
        "version": "11.1.0"
      }
    ]
  },
  {
    "product": "TIBCO Spotfire Analytics Platform for AWS Marketplace",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "11.1.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TIBCO Spotfire Desktop",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "10.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.10.0"
      },
      {
        "status": "affected",
        "version": "10.10.1"
      },
      {
        "status": "affected",
        "version": "10.10.2"
      },
      {
        "status": "affected",
        "version": "10.7.0"
      },
      {
        "status": "affected",
        "version": "10.8.0"
      },
      {
        "status": "affected",
        "version": "10.9.0"
      },
      {
        "status": "affected",
        "version": "11.0.0"
      },
      {
        "status": "affected",
        "version": "11.1.0"
      }
    ]
  },
  {
    "product": "TIBCO Spotfire Server",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "10.3.11",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "10.10.0"
      },
      {
        "status": "affected",
        "version": "10.10.1"
      },
      {
        "status": "affected",
        "version": "10.10.2"
      },
      {
        "status": "affected",
        "version": "10.10.3"
      },
      {
        "status": "affected",
        "version": "10.7.0"
      },
      {
        "status": "affected",
        "version": "10.8.0"
      },
      {
        "status": "affected",
        "version": "10.8.1"
      },
      {
        "status": "affected",
        "version": "10.9.0"
      },
      {
        "status": "affected",
        "version": "11.0.0"
      },
      {
        "status": "affected",
        "version": "11.1.0"
      }
    ]
  }
]

References

www.tibco.com/services/support/advisories

www.tibco.com/support/advisories/2021/03/tibco-security-advisory-march-9-2021-tibco-spotfire

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVELIST:CVE-2021-23273