CVE-2020-9416
Published: Sep 15, 2020
Modified: Sep 16, 2024
CVSS v3.1
8.2
Description
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
| Vendor | Product | Versions |
|---|---|---|
TIBCO Software Inc. | TIBCO Spotfire Analyst | affected 10.7.0affected 10.8.0affected 10.9.0affected 10.10.0 |
TIBCO Software Inc. | TIBCO Spotfire Analytics Platform for AWS Marketplace | affected 10.7.0affected 10.8.0affected 10.8.1affected 10.9.0affected 10.10.0+1 more versions |
TIBCO Software Inc. | TIBCO Spotfire Desktop | affected 10.7.0affected 10.8.0affected 10.9.0affected 10.10.0 |
TIBCO Software Inc. | TIBCO Spotfire Server | affected 10.7.0affected 10.8.0affected 10.8.1affected 10.9.0affected 10.10.0+1 more versions |
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now