CVE-2019-17335: TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2019-17335?
CVE-2019-17335 is a vulnerability in the Data access layer component of TIBCO Spotfire Analytics Platform and TIBCO Spotfire Server that allows an attacker to access cached data from a data source.
Which software is affected by CVE-2019-17335?
CVE-2019-17335 affects TIBCO Spotfire Analytics Platform for AWS Marketplace (version 10.6.0) and TIBCO Spotfire Server (versions 7.11.7 to 10.6.0).
What is the severity of CVE-2019-17335?
CVE-2019-17335 has a severity rating of 6.5 (medium).
How can an attacker exploit CVE-2019-17335?
An attacker can exploit CVE-2019-17335 by accessing and extracting cached data from a data source.
Is there a fix for CVE-2019-17335?
Yes, TIBCO Software Inc. has released security advisories with fixes for CVE-2019-17335. Please refer to the provided references for more information.