high
8.8
Advisory Published
Updated

CVE-2021-28830: TIBCO Spotfire Windows Platform Artifact Search vulnerability

First published: Tue Jun 29 2021(Updated: )

The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.

Credit: security@tibco.com

Affected SoftwareAffected VersionHow to fix
TIBCO Enterprise Runtime for R<=1.2.4
TIBCO Enterprise Runtime for R=1.3.0
TIBCO Enterprise Runtime for R=1.3.1
TIBCO Enterprise Runtime for R=1.4.0
TIBCO Enterprise Runtime for R=1.5.0
TIBCO Enterprise Runtime for R=1.6.0
Tibco Spotfire Analytics Platform<=11.3.0
TIBCO Spotfire Server<=10.3.12
TIBCO Spotfire Server=10.4.0
TIBCO Spotfire Server=10.5.0
TIBCO Spotfire Server=10.6.0
TIBCO Spotfire Server=10.6.1
TIBCO Spotfire Server=10.7.0
TIBCO Spotfire Server=10.8.0
TIBCO Spotfire Server=10.8.1
TIBCO Spotfire Server=10.9.0
TIBCO Spotfire Server=10.10.0
TIBCO Spotfire Server=10.10.1
TIBCO Spotfire Server=10.10.2
TIBCO Spotfire Server=10.10.3
TIBCO Spotfire Server=10.10.4
TIBCO Spotfire Server=11.0.0
TIBCO Spotfire Server=11.1.0
TIBCO Spotfire Server=11.2.0
TIBCO Spotfire Server=11.3.0
TIBCO Spotfire Statistics Services<=10.3.0
TIBCO Spotfire Statistics Services=10.10.0
TIBCO Spotfire Statistics Services=10.10.1
TIBCO Spotfire Statistics Services=10.10.2
TIBCO Spotfire Statistics Services=11.1.0
TIBCO Spotfire Statistics Services=11.2.0
TIBCO Spotfire Statistics Services=11.3.0

Remedy

TIBCO has released updated versions of the affected components which address these issues. TIBCO Enterprise Runtime for R - Server Edition versions 1.2.4 and below update to version 1.2.5 or later TIBCO Enterprise Runtime for R - Server Edition versions 1.3.0 and 1.3.1 update to version 1.3.2 or later TIBCO Enterprise Runtime for R - Server Edition versions 1.4.0, 1.5.0, and 1.6.0 update to version 1.7.0 or later TIBCO Spotfire Analytics Platform for AWS Marketplace versions 11.3.0 and below update to version 11.4.0 or later TIBCO Spotfire Server versions 10.3.12 and below update to version 10.3.13 or later TIBCO Spotfire Server versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4 update to version 10.10.5 or later TIBCO Spotfire Server versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later TIBCO Spotfire Statistics Services versions 10.3.0 and below update to version 10.3.1 or later TIBCO Spotfire Statistics Services versions 10.10.0, 10.10.1, and 10.10.2 update to version 10.10.3 or later TIBCO Spotfire Statistics Services versions 11.1.0, 11.2.0, and 11.3.0 update to version 11.4.0 or later

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID of this issue?

    The vulnerability ID of this issue is CVE-2021-28830.

  • What is the severity of CVE-2021-28830?

    The severity of CVE-2021-28830 is high with a severity value of 7.8.

  • Which software components are affected by CVE-2021-28830?

    The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace are affected.

  • How can I fix CVE-2021-28830?

    Apply the necessary security patches or updates provided by TIBCO Software Inc.

  • Where can I find more information about CVE-2021-28830?

    You can find more information about CVE-2021-28830 on TIBCO Software Inc.'s advisory pages: [advisories](http://www.tibco.com/services/support/advisories) and [TIBCO Security Advisory](https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203