CVE-2018-12410: TIBCO Spotfire Statistics Services remote execution vulnerabilities
First published: Wed Oct 10 2018(Updated: )
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire Statistics Services | <=7.11.0 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. In addition to the updates, security related configuration changes may be required due to new defaults. Please review the documentation. For each affected system, update to the corresponding software versions: - TIBCO Spotfire Statistics Services versions 7.11.0 and below update to version 7.11.1 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-12410?
CVE-2018-12410 is a vulnerability in TIBCO Spotfire Statistics Services that allows remote code execution.
How severe is CVE-2018-12410?
CVE-2018-12410 has a severity rating of critical (9.8).
What software is affected by CVE-2018-12410?
TIBCO Spotfire Statistics Services version 7.11.0 is affected by CVE-2018-12410.
How can CVE-2018-12410 be exploited?
CVE-2018-12410 can be exploited by an attacker who does not need to authenticate, allowing remote code execution with the system account's permissions.
How can I fix CVE-2018-12410?
To fix CVE-2018-12410, it is recommended to update TIBCO Spotfire Statistics Services to a version that includes a security patch.
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/remedy
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/tibco
- canonical/tibco spotfire statistics services
- version/tibco spotfire statistics services/7.11.0