CVE-2023-26220: TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability
First published: Tue Oct 10 2023(Updated: )
The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.
Credit: security@tibco.com security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire Analyst | <=11.4.7 | |
| TIBCO Spotfire Analyst | =11.5.0 | |
| TIBCO Spotfire Analyst | =11.6.0 | |
| TIBCO Spotfire Analyst | =11.7.0 | |
| TIBCO Spotfire Analyst | =11.8.0 | |
| TIBCO Spotfire Analyst | =12.0.0 | |
| TIBCO Spotfire Analyst | =12.0.1 | |
| TIBCO Spotfire Analyst | =12.0.2 | |
| TIBCO Spotfire Analyst | =12.0.3 | |
| TIBCO Spotfire Analyst | =12.0.4 | |
| TIBCO Spotfire Analyst | =12.1.0 | |
| TIBCO Spotfire Analyst | =12.1.1 | |
| TIBCO Spotfire Server | <=11.4.11 | |
| TIBCO Spotfire Server | =11.5.0 | |
| TIBCO Spotfire Server | =11.6.0 | |
| TIBCO Spotfire Server | =11.6.1 | |
| TIBCO Spotfire Server | =11.6.2 | |
| TIBCO Spotfire Server | =11.6.3 | |
| TIBCO Spotfire Server | =11.7.0 | |
| TIBCO Spotfire Server | =11.8.0 | |
| TIBCO Spotfire Server | =11.8.1 | |
| TIBCO Spotfire Server | =12.0.0 | |
| TIBCO Spotfire Server | =12.0.1 | |
| TIBCO Spotfire Server | =12.0.2 | |
| TIBCO Spotfire Server | =12.0.3 | |
| TIBCO Spotfire Server | =12.0.4 | |
| TIBCO Spotfire Server | =12.0.5 | |
| TIBCO Spotfire Server | =12.1.0 | |
| TIBCO Spotfire Server | =12.1.1 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. Spotfire Analyst versions 11.4.7 and below: update to version 11.4.8 or later Spotfire Analyst versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4: update to version 12.0.5 or later Spotfire Analyst versions 12.1.0 and 12.1.1: update to version 12.5.0 or later Spotfire Server versions 11.4.11 and below: update to version 11.4.12 or later Spotfire Server versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5: update to version 12.0.6 or later Spotfire Server versions 12.1.0 and 12.1.1: update to version 12.5.0 or later
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2023-26220.
What is the severity level of CVE-2023-26220?
The severity level of CVE-2023-26220 is medium (5.4).
What software components are affected by CVE-2023-26220?
TIBCO Spotfire Analyst and TIBCO Spotfire Server are affected by CVE-2023-26220.
How can an attacker exploit CVE-2023-26220?
An attacker with network access can exploit CVE-2023-26220 to execute a Stored Cross Site Scripting (XSS) attack on the affected system.
Where can I find more information about CVE-2023-26220?
You can find more information about CVE-2023-26220 on the TIBCO Software Inc. advisory page.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/tibco
- canonical/tibco spotfire analyst
- version/tibco spotfire analyst/11.4.7
- version/tibco spotfire analyst/11.5.0
- version/tibco spotfire analyst/11.6.0
- version/tibco spotfire analyst/11.7.0
- version/tibco spotfire analyst/11.8.0
- version/tibco spotfire analyst/12.0.0
- version/tibco spotfire analyst/12.0.1
- version/tibco spotfire analyst/12.0.2
- version/tibco spotfire analyst/12.0.3
- version/tibco spotfire analyst/12.0.4
- version/tibco spotfire analyst/12.1.0
- version/tibco spotfire analyst/12.1.1
- canonical/tibco spotfire server
- version/tibco spotfire server/11.4.11
- version/tibco spotfire server/11.5.0
- version/tibco spotfire server/11.6.0
- version/tibco spotfire server/11.6.1
- version/tibco spotfire server/11.6.2
- version/tibco spotfire server/11.6.3
- version/tibco spotfire server/11.7.0
- version/tibco spotfire server/11.8.0
- version/tibco spotfire server/11.8.1
- version/tibco spotfire server/12.0.0
- version/tibco spotfire server/12.0.1
- version/tibco spotfire server/12.0.2
- version/tibco spotfire server/12.0.3
- version/tibco spotfire server/12.0.4
- version/tibco spotfire server/12.0.5
- version/tibco spotfire server/12.1.0
- version/tibco spotfire server/12.1.1