PT-2023-20549 · Tibco Software · Spotfire For Aws Marketplace+2

Publicado 2023-11-08 · Atualizado 2023-11-16 · CVE-2023-26221

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIBCO Software Inc.'s Spotfire Analyst versions 12.3.0 through 12.5.0 TIBCO Software Inc.'s Spotfire Server versions 12.3.0 through 12.5.0 TIBCO Software Inc.'s Spotfire for AWS Marketplace version 12.5.0

Description The Spotfire Connectors component contains an easily exploitable issue that allows a low-privileged attacker with read/write access to craft malicious Analyst files. A successful attack requires human interaction from a person other than the attacker.

Recommendations For TIBCO Software Inc.'s Spotfire Analyst versions 12.3.0 through 12.5.0, update to a version that contains a fix for this issue. For TIBCO Software Inc.'s Spotfire Server versions 12.3.0 through 12.5.0, update to a version that contains a fix for this issue. For TIBCO Software Inc.'s Spotfire for AWS Marketplace version 12.5.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Spotfire Connectors component until a patch is available.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2023-26221

Produtos afetados

Spotfire Analyst

Spotfire Server

Spotfire For Aws Marketplace

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-26221 · Nota de Segurança
• https://tibco.com/services/support/advisories · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-26221 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1722347255997641147 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1722372553719599271 · Publicação no Twitter