PT-2021-23737 · Tibco · Tibco Spotfire Server

Published 2021-12-14 · Updated 2022-07-12 · CVE-2021-43051

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO Spotfire Server versions 10.10.6 and below TIBCO Spotfire Server versions 11.0.0 through 11.4.1 TIBCO Spotfire Server versions 11.5.0 through 11.6.0

Description The Spotfire Server component contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker.

Recommendations For TIBCO Spotfire Server versions 10.10.6 and below, update to a version above 10.10.6. For TIBCO Spotfire Server versions 11.0.0 through 11.4.1, update to a version above 11.4.1. For TIBCO Spotfire Server versions 11.5.0 through 11.6.0, update to a version above 11.6.0. As a temporary workaround, consider restricting access to internal API operations to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-43051

Affected Products

Tibco Spotfire Server

References · 5

• https://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43051 · Vendor Advisory
• https://tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43051 · Security Note
• https://t.me/cibsecurity/33973 · Telegram Post