PT-2023-20549 · Tibco Software · Spotfire For Aws Marketplace+2

Published 2023-11-08 · Updated 2023-11-16 · CVE-2023-26221

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIBCO Software Inc.'s Spotfire Analyst versions 12.3.0 through 12.5.0 TIBCO Software Inc.'s Spotfire Server versions 12.3.0 through 12.5.0 TIBCO Software Inc.'s Spotfire for AWS Marketplace version 12.5.0

Description The Spotfire Connectors component contains an easily exploitable issue that allows a low-privileged attacker with read/write access to craft malicious Analyst files. A successful attack requires human interaction from a person other than the attacker.

Recommendations For TIBCO Software Inc.'s Spotfire Analyst versions 12.3.0 through 12.5.0, update to a version that contains a fix for this issue. For TIBCO Software Inc.'s Spotfire Server versions 12.3.0 through 12.5.0, update to a version that contains a fix for this issue. For TIBCO Software Inc.'s Spotfire for AWS Marketplace version 12.5.0, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Spotfire Connectors component until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-26221

Affected Products

Spotfire Analyst

Spotfire Server

Spotfire For Aws Marketplace

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-26221 · Security Note
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-26221 · Vendor Advisory
• https://twitter.com/CVEnew/status/1722347255997641147 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1722372553719599271 · Twitter Post