CVE-2023-26221: TIBCO Spotfire Insufficiently Protected Credential vulnerability
The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2023-26221?
CVE-2023-26221 is a vulnerability in TIBCO Spotfire that allows a low privileged attacker to craft malicious Analyst files.
Which versions of TIBCO Spotfire are affected by CVE-2023-26221?
TIBCO Spotfire Analyst versions 12.3.0, 12.4.0, and 12.5.0, as well as TIBCO Spotfire Server versions 12.3.0, 12.4.0, and 12.5.0, and Tibco Spotfire Analytics Platform version 12.5.0 are affected.
What is the severity of CVE-2023-26221?
CVE-2023-26221 has a severity rating of medium (5 out of 10).
How can an attacker exploit CVE-2023-26221?
An attacker with low privileges and read/write access can exploit CVE-2023-26221 by crafting malicious Analyst files.
Is there a fix available for CVE-2023-26221?
It is recommended to update to the latest patched version of TIBCO Spotfire to mitigate the vulnerability.