Vulnerability · Published Sep 15, 2020 · Assigned by tibco
CVE-2020-9416TIBCO Spotfire Stored Cross Site Scripting Vulnerability
High 8.2
In plain English
A high-severity security flaw in TIBCO Spotfire Analyst from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TIBCO Software Inc. | TIBCO Spotfire Analyst | 10.7.010.8.010.9.010.10.0 |
| TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace | 10.7.010.8.010.8.110.9.010.10.010.10.1 |
| TIBCO Software Inc. | TIBCO Spotfire Desktop | 10.7.010.8.010.9.010.10.0 |
| TIBCO Software Inc. | TIBCO Spotfire Server | 10.7.010.8.010.8.110.9.010.10.010.10.1 |
References
- http://www.tibco.com/services/support/advisories x_refsource_CONFIRM
- https://www.tibco.com/support/advisories/2020/09/tibco-security-advisory-september-15-2020-tibco-spotfire x_refsource_CONFIRM