Vulnerability · Published Apr 9, 2025 · Assigned by tibco
CVE-2025-3115Spotfire Data Function Vulnerability
Critical 9.4
In plain English
A critical-severity code injection in Deployment Kit used in Spotfire Server from Spotfire. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spotfire | Spotfire Statistics Services | 14 – before 14.0.714.1.014.2.014.3.014.4.014.4.1 |
| Spotfire | Spotfire Analyst | 14.0 – before 14.0.614.1.014.2.014.3.014.4.014.4.1 |
| Spotfire | Deployment Kit used in Spotfire Server | 14.0 – before 14.0.714.1.014.2.014.3.014.4.014.4.1 |
| Spotfire | Spotfire Desktop | 14.4 – before 14.4.2 |
| Spotfire | Spotfire for AWS Marketplace | see references |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.17 – before 1.17.71.18.01.19.01.20.01.21.01.21.1 |
| Spotfire | Spotfire Service for Python | 1.17 – before 1.17.71.18.0 – through 1.21.1 |
| Spotfire | Spotfire Service for R | 1.17 – before 1.17.71.18.0 – through 1.21.1 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H