PT-2020-20640 · Tibco · Spotfire Library+4

Published 2020-03-11 · Updated 2020-03-13 · CVE-2020-9408

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below TIBCO Spotfire Server versions 7.11.9 and below TIBCO Spotfire Server versions 7.12.0 through 10.8.0

Description The Spotfire library component contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes.

Recommendations For TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.8.0 and below, update to a version above 10.8.0. For TIBCO Spotfire Server versions 7.11.9 and below, update to a version above 7.11.9. For TIBCO Spotfire Server versions 7.12.0 through 10.8.0, update to a version above 10.8.0. As a temporary workaround, consider restricting write permissions to the Spotfire Library to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-9408

Affected Products

Spotfire Library

Spotfire Web Player

Terr Service

Tibco Spotfire Analytics Platform For Aws Marketplace

Tibco Spotfire Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-9408 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9408 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://tibco.com/support/advisories/2020/03/tibco-security-advisory-march-11-2020-tibco-spotfire-server · Vendor Advisory
• https://t.me/cvenotify/1523 · Telegram Post