PT-2018-11151 · Tibco Software · Tibco Spotfire Statistics Services

Published 2018-10-10 · Updated 2019-10-09 · CVE-2018-12410

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Statistics Services versions up to and including 7.11.0

Description The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple issues that may allow remote code execution. An attacker may be able to execute code with the permissions of the system account used to run the web server component without needing to authenticate.

Recommendations For TIBCO Spotfire Statistics Services versions up to and including 7.11.0, update to a version later than 7.11.0 to resolve the issue.

Fix

Related Identifiers

CVE-2018-12410

Affected Products

Tibco Spotfire Statistics Services

References · 4

• https://osv.dev/vulnerability/CVE-2018-12410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12410 · Security Note
• https://tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics · Note
• http://securityfocus.com/bid/105558 · Note