high
8.8
CWE
732
Advisory Published
Updated

CVE-2021-23275: TIBCO Spotfire Windows Platform Installation vulnerability

First published: Tue Jun 29 2021(Updated: )

The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.

Credit: security@tibco.com

Affected SoftwareAffected VersionHow to fix
TIBCO Enterprise Runtime for R<=1.2.4
TIBCO Enterprise Runtime for R=1.3.0
TIBCO Enterprise Runtime for R=1.3.1
TIBCO Enterprise Runtime for R=1.4.0
TIBCO Enterprise Runtime for R=1.5.0
TIBCO Enterprise Runtime for R=1.6.0
Tibco Spotfire Analytics Platform<=11.3.0
TIBCO Spotfire Server<=10.3.12
TIBCO Spotfire Server=10.4.0
TIBCO Spotfire Server=10.5.0
TIBCO Spotfire Server=10.6.0
TIBCO Spotfire Server=10.6.1
TIBCO Spotfire Server=10.7.0
TIBCO Spotfire Server=10.8.0
TIBCO Spotfire Server=10.8.1
TIBCO Spotfire Server=10.9.0
TIBCO Spotfire Server=10.10.0
TIBCO Spotfire Server=10.10.1
TIBCO Spotfire Server=10.10.2
TIBCO Spotfire Server=10.10.3
TIBCO Spotfire Server=10.10.4
TIBCO Spotfire Server=11.0.0
TIBCO Spotfire Server=11.1.0
TIBCO Spotfire Server=11.2.0
TIBCO Spotfire Server=11.3.0
TIBCO Spotfire Statistics Services<=10.3.0
TIBCO Spotfire Statistics Services=10.10.0
TIBCO Spotfire Statistics Services=10.10.1
TIBCO Spotfire Statistics Services=10.10.2
TIBCO Spotfire Statistics Services=11.1.0
TIBCO Spotfire Statistics Services=11.2.0
TIBCO Spotfire Statistics Services=11.3.0

Remedy

TIBCO has released updated versions of the affected components which address these issues. TIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later TIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later TIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later TIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later TIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later TIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later TIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later TIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later TIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later TIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2021-23275?

    CVE-2021-23275 is a vulnerability in the Windows Installation component of TIBCO Enterprise Runtime for R - Server Edition and TIBCO Spotfire Server.

  • How severe is CVE-2021-23275?

    CVE-2021-23275 has a severity rating of 7.8 (high).

  • Which software versions are affected by CVE-2021-23275?

    CVE-2021-23275 affects TIBCO Enterprise Runtime for R versions 1.2.4 to 1.6.0, TIBCO Spotfire Server versions 10.3.12 to 11.3.0, and TIBCO Spotfire Analytics Platform versions up to 11.3.0.

  • How can I fix CVE-2021-23275?

    To fix CVE-2021-23275, it is recommended to apply the necessary patches or updates provided by TIBCO Software Inc.

  • Where can I find more information about CVE-2021-23275?

    More information about CVE-2021-23275 can be found on the TIBCO Software Inc. support advisories page and the TIBCO Security Advisory for June 29, 2021.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203