CVE-2019-17335: TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users
First published: Tue Dec 17 2019(Updated: )
The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire Analytics Platform for AWS | =10.6.0 | |
| TIBCO Spotfire Server | <=7.11.7 | |
| TIBCO Spotfire Server | =7.12.0 | |
| TIBCO Spotfire Server | =7.13.0 | |
| TIBCO Spotfire Server | =7.14.0 | |
| TIBCO Spotfire Server | =10.0.0 | |
| TIBCO Spotfire Server | =10.0.1 | |
| TIBCO Spotfire Server | =10.1.0 | |
| TIBCO Spotfire Server | =10.2.0 | |
| TIBCO Spotfire Server | =10.2.1 | |
| TIBCO Spotfire Server | =10.3.0 | |
| TIBCO Spotfire Server | =10.3.1 | |
| TIBCO Spotfire Server | =10.3.2 | |
| TIBCO Spotfire Server | =10.3.3 | |
| TIBCO Spotfire Server | =10.3.4 | |
| TIBCO Spotfire Server | =10.4.0 | |
| TIBCO Spotfire Server | =10.5.0 | |
| TIBCO Spotfire Server | =10.6.0 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analytics Platform for AWS Marketplace version 10.6.0 update to version 10.6.1 or higher TIBCO Spotfire Server versions 7.11.7 and below update to version 7.11.8 or higher TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4 update to version 10.3.5 or higher TIBCO Spotfire Server versions 10.4.0, 10.5.0, and 10.6.0 update to version 10.6.1 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-17335?
CVE-2019-17335 is a vulnerability in the Data access layer component of TIBCO Spotfire Analytics Platform and TIBCO Spotfire Server that allows an attacker to access cached data from a data source.
Which software is affected by CVE-2019-17335?
CVE-2019-17335 affects TIBCO Spotfire Analytics Platform for AWS Marketplace (version 10.6.0) and TIBCO Spotfire Server (versions 7.11.7 to 10.6.0).
What is the severity of CVE-2019-17335?
CVE-2019-17335 has a severity rating of 6.5 (medium).
How can an attacker exploit CVE-2019-17335?
An attacker can exploit CVE-2019-17335 by accessing and extracting cached data from a data source.
Is there a fix for CVE-2019-17335?
Yes, TIBCO Software Inc. has released security advisories with fixes for CVE-2019-17335. Please refer to the provided references for more information.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/severity
- agent/title
- agent/author
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/event
- vendor/tibco
- canonical/tibco spotfire analytics platform for aws
- version/tibco spotfire analytics platform for aws/10.6.0
- canonical/tibco spotfire server
- version/tibco spotfire server/7.11.7
- version/tibco spotfire server/7.12.0
- version/tibco spotfire server/7.13.0
- version/tibco spotfire server/7.14.0
- version/tibco spotfire server/10.0.0
- version/tibco spotfire server/10.0.1
- version/tibco spotfire server/10.1.0
- version/tibco spotfire server/10.2.0
- version/tibco spotfire server/10.2.1
- version/tibco spotfire server/10.3.0
- version/tibco spotfire server/10.3.1
- version/tibco spotfire server/10.3.2
- version/tibco spotfire server/10.3.3
- version/tibco spotfire server/10.3.4
- version/tibco spotfire server/10.4.0
- version/tibco spotfire server/10.5.0
- version/tibco spotfire server/10.6.0