CVE-2022-41558: TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
First published: Tue Nov 15 2022(Updated: )
The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Desktop, TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 11.4.4 and below, TIBCO Spotfire Analyst: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Analyst: version 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 12.1.0 and below, TIBCO Spotfire Desktop: versions 11.4.4 and below, TIBCO Spotfire Desktop: versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1, TIBCO Spotfire Desktop: version 12.1.0, TIBCO Spotfire Server: versions 11.4.8 and below, TIBCO Spotfire Server: versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1, and TIBCO Spotfire Server: version 12.1.0.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire Analyst | <=11.4.4 | |
| TIBCO Spotfire Analyst | =11.5.0 | |
| TIBCO Spotfire Analyst | =11.6.0 | |
| TIBCO Spotfire Analyst | =11.7.0 | |
| TIBCO Spotfire Analyst | =11.8.0 | |
| TIBCO Spotfire Analyst | =12.0.0 | |
| TIBCO Spotfire Analyst | =12.0.1 | |
| TIBCO Spotfire Analyst | =12.1.0 | |
| Tibco Spotfire Analytics Platform | <=12.1.0 | |
| TIBCO Spotfire Desktop | <=11.4.4 | |
| TIBCO Spotfire Desktop | =11.5.0 | |
| TIBCO Spotfire Desktop | =11.6.0 | |
| TIBCO Spotfire Desktop | =11.7.0 | |
| TIBCO Spotfire Desktop | =11.8.0 | |
| TIBCO Spotfire Desktop | =12.0.0 | |
| TIBCO Spotfire Desktop | =12.0.1 | |
| TIBCO Spotfire Desktop | =12.1.0 | |
| TIBCO Spotfire Server | <=11.4.8 | |
| TIBCO Spotfire Server | =11.5.0 | |
| TIBCO Spotfire Server | =11.6.0 | |
| TIBCO Spotfire Server | =11.6.1 | |
| TIBCO Spotfire Server | =11.6.2 | |
| TIBCO Spotfire Server | =11.6.3 | |
| TIBCO Spotfire Server | =11.7.0 | |
| TIBCO Spotfire Server | =11.8.0 | |
| TIBCO Spotfire Server | =11.8.1 | |
| TIBCO Spotfire Server | =12.0.0 | |
| TIBCO Spotfire Server | =12.0.1 | |
| TIBCO Spotfire Server | =12.1.0 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analyst versions 11.4.4 and below: update to version 11.4.5 or later TIBCO Spotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later TIBCO Spotfire Analyst version 12.1.0: update to version 12.1.1 or later TIBCO Spotfire Analytics Platform for AWS Marketplace versions 12.1.0 and below: update to version 12.1.1 or later TIBCO Spotfire Desktop versions 11.4.4 and below: update to version 11.4.5 or later TIBCO Spotfire Desktop versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, and 12.0.1: update to version 12.0.2 or later TIBCO Spotfire Desktop version 12.1.0: update to version 12.1.1 or later TIBCO Spotfire Server versions 11.4.8 and below: update to version 11.4.9 or later TIBCO Spotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, and 12.0.1: update to version 12.0.2 or later TIBCO Spotfire Server version 12.1.0: update to version 12.1.1 or later
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID associated with this security advisory?
The vulnerability ID associated with this security advisory is CVE-2022-41558.
What is the severity of CVE-2022-41558?
The severity of CVE-2022-41558 is critical with a CVSS score of 5.4.
Which software versions are affected by CVE-2022-41558?
CVE-2022-41558 affects TIBCO Spotfire Analyst versions 11.4.4 to 12.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop versions 11.4.4 to 12.1.0, and TIBCO Spotfire Server versions 11.4.8 to 12.1.0.
How can I fix CVE-2022-41558?
To fix CVE-2022-41558, it is recommended to upgrade to the latest patched version of the affected software.
Where can I find more information about CVE-2022-41558?
You can find more information about CVE-2022-41558 in the security advisory provided by TIBCO Software Inc.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/title
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/tibco
- canonical/tibco spotfire analyst
- version/tibco spotfire analyst/11.4.4
- version/tibco spotfire analyst/11.5.0
- version/tibco spotfire analyst/11.6.0
- version/tibco spotfire analyst/11.7.0
- version/tibco spotfire analyst/11.8.0
- version/tibco spotfire analyst/12.0.0
- version/tibco spotfire analyst/12.0.1
- version/tibco spotfire analyst/12.1.0
- canonical/tibco spotfire analytics platform
- version/tibco spotfire analytics platform/12.1.0
- canonical/tibco spotfire desktop
- version/tibco spotfire desktop/11.4.4
- version/tibco spotfire desktop/11.5.0
- version/tibco spotfire desktop/11.6.0
- version/tibco spotfire desktop/11.7.0
- version/tibco spotfire desktop/11.8.0
- version/tibco spotfire desktop/12.0.0
- version/tibco spotfire desktop/12.0.1
- version/tibco spotfire desktop/12.1.0
- canonical/tibco spotfire server
- version/tibco spotfire server/11.4.8
- version/tibco spotfire server/11.5.0
- version/tibco spotfire server/11.6.0
- version/tibco spotfire server/11.6.1
- version/tibco spotfire server/11.6.2
- version/tibco spotfire server/11.6.3
- version/tibco spotfire server/11.7.0
- version/tibco spotfire server/11.8.0
- version/tibco spotfire server/11.8.1
- version/tibco spotfire server/12.0.0
- version/tibco spotfire server/12.0.1
- version/tibco spotfire server/12.1.0