CVE-2024-3331: Spotfire: NTLM token leakage

Q: What is the severity of CVE-2024-3331?

The severity of CVE-2024-3331 depends on the privileges of the user running the affected software.

Q: How do I fix CVE-2024-3331?

To fix CVE-2024-3331, upgrade to the latest version of the TIBCO Spotfire software that addresses this vulnerability.

Q: What products are affected by CVE-2024-3331?

CVE-2024-3331 affects TIBCO Spotfire Enterprise Runtime for R - Server Edition, Statistics Services, Analyst, Desktop, and Server.

Q: What versions are vulnerable to CVE-2024-3331?

Versions of the affected TIBCO Spotfire products between specified ranges are vulnerable to CVE-2024-3331.

Q: What type of vulnerability is CVE-2024-3331?

CVE-2024-3331 is a user privilege escalation vulnerability in several TIBCO Spotfire products.

Published Jun 27, 2024

Updated

Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spotfire Spotfire Analyst, Spotfire Spotfire Desktop, Spotfire Spotfire Server allows The impact of this vulnerability depends on the privileges of the user running the affected software..This issue affects Spotfire Enterprise Runtime for R - Server Edition: from 1.12.7 through 1.20.0; Spotfire Statistics Services: from 12.0.7 through 12.3.1, from 14.0.0 through 14.3.0; Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0.0 through 14.3.0; Spotfire Desktop: from 14.0 through 14.3.0; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0.0 through 14.3.0.

Affected Software

5 affected components

Spotfire Enterprise Runtime for R - Server Edition>=1.12.7<1.20.0

Spotfire Statistics Services>=12.0.7<12.3.1, >=14.0.0<14.3.0

Spotfire Analyst>=12.0.9<12.5.0, >=14.0.0<14.3.0

Spotfire Desktop>=14.0<14.3.0

Spotfire Server>=12.0.10<12.5.0, >=14.0.0<14.3.0

Remediation

Information

* Spotfire Enterprise Runtime for R (aka TERR) 4.5.0, 5.0.0, 5.1.0, 6.0.0, 6.0.1, 6.0.2, 6.0.3, 6.1.0, 6.1.1, 6.1.2: upgrade to version 6.1.3 or higher * Spotfire Enterprise Runtime for R - Server Edition 1.12.7 and earlier: upgrade to version 1.12.8 or higher * Spotfire Enterprise Runtime for R - Server Edition 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1.17.1, 1.17.2, 1.17.3: upgrade to version 1.17.4 or higher * Spotfire Enterprise Runtime for R - Server Edition 1.18.0, 1.19.0, 1.20.0: upgrade to version 1.21.0 or higher * Spotfire Statistics Services 12.0.7 and earlier: upgrade to version 12.0.8 or higher * Spotfire Statistics Services 12.1.0, 12.2.0, 12.3.0, 12.3.1, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher * Spotfire Statistics Services 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0 or higher * Spotfire Analyst 12.0.9 and earlier: upgrade to version 12.0.10 or higher * Spotfire Analyst 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2: upgrade to version 14.0.3 or higher * Spotfire Analyst 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0 or higher * Spotfire Desktop 14.3.0 and earlier: upgrade to version 14.4.0 or higher * Spotfire Server 12.0.10 and earlier: upgrade to version 12.0.11 or higher * Spotfire Server 12.1.0, 12.1.1, 12.2.0, 12.3.0, 12.4.0, 12.5.0, 14.0.0, 14.0.1, 14.0.2, 14.0.3: upgrade to version 14.0.4 or higher * Spotfire Server 14.1.0, 14.2.0, 14.3.0: upgrade to version 14.4.0 or higher * Spotfire for AWS Marketplace 14.3.0 and earlier: upgrade to version 14.4.0 or higher

Event History

Jun 27, 2024

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

RemedyDescriptionSeverity

Data Sourced

via NVD·07:15 PM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2024-3331?

The severity of CVE-2024-3331 depends on the privileges of the user running the affected software.

How do I fix CVE-2024-3331?

To fix CVE-2024-3331, upgrade to the latest version of the TIBCO Spotfire software that addresses this vulnerability.

What products are affected by CVE-2024-3331?