CVE-2020-9416: TIBCO Spotfire Stored Cross Site Scripting Vulnerability

Published Sep 15, 2020

Updated

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.

Affected Software

20 affected components

TIBCO Spotfire Analyst=10.7.0

TIBCO Spotfire Analyst=10.8.0

TIBCO Spotfire Analyst=10.9.0

TIBCO Spotfire Analyst=10.10.0

TIBCO Spotfire Analytics Platform Aws Marketplace=10.7.0

TIBCO Spotfire Analytics Platform Aws Marketplace=10.8.0

TIBCO Spotfire Analytics Platform Aws Marketplace=10.8.1

TIBCO Spotfire Analytics Platform Aws Marketplace=10.9.0

TIBCO Spotfire Analytics Platform Aws Marketplace=10.10.0

TIBCO Spotfire Analytics Platform Aws Marketplace=10.10.1

TIBCO Spotfire Desktop=10.7.0

TIBCO Spotfire Desktop=10.8.0

TIBCO Spotfire Desktop=10.9.0

TIBCO Spotfire Desktop=10.10.0

TIBCO Spotfire server=10.7.0

TIBCO Spotfire server=10.8.0

TIBCO Spotfire server=10.8.1

TIBCO Spotfire server=10.9.0

TIBCO Spotfire server=10.10.0

TIBCO Spotfire server=10.10.1

Remediation

Information

TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher TIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0 update to version 10.10.1 or higher TIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1 update to version 10.10.2 or higher

Event History

Sep 15, 2020

CVE Published

via MITRE·06:55 PM

Data Sourced

via MITRE·06:55 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2020-9416?

CVE-2020-9416 is a vulnerability in the Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server that allows a legitimate user to inject scripts.

How severe is CVE-2020-9416?

CVE-2020-9416 has a severity rating of high with a CVSS score of 5.4.

Which software versions are affected by CVE-2020-9416?

CVE-2020-9416 affects TIBCO Spotfire Analyst versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.

How do I fix CVE-2020-9416?

To fix CVE-2020-9416, it is recommended to upgrade to the latest version of TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform, TIBCO Spotfire Desktop, and TIBCO Spotfire Server.

Where can I find more information about CVE-2020-9416?

More information about CVE-2020-9416 can be found on the TIBCO Software Inc. advisory page and the TIBCO support advisories page.