CVE-2025-3115: Spotfire Data Function Vulnerability
First published: Wed Apr 09 2025(Updated: )
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO Spotfire | ||
| TIBCO Spotfire Enterprise Runtime for R | <6.1.5 | |
| TIBCO Spotfire Statistics Services | <14.0.7 | |
| TIBCO Spotfire Statistics Services | =14.1.0 | |
| TIBCO Spotfire Statistics Services | =14.2.0 | |
| TIBCO Spotfire Statistics Services | =14.3.0 | |
| TIBCO Spotfire Statistics Services | =14.4.0 | |
| TIBCO Spotfire Statistics Services | =14.4.1 | |
| TIBCO Spotfire Enterprise Runtime for R | <1.17.7 | |
| TIBCO Spotfire Enterprise Runtime for R | =1.18.0 | |
| TIBCO Spotfire Enterprise Runtime for R | =1.19.0 | |
| TIBCO Spotfire Enterprise Runtime for R | =1.20.0 | |
| TIBCO Spotfire Enterprise Runtime for R | =1.21.0 | |
| TIBCO Spotfire Enterprise Runtime for R | =1.21.1 | |
| TIBCO Spotfire Analyst | <14.0.6 | |
| TIBCO Spotfire Analyst | =14.1.0 | |
| TIBCO Spotfire Analyst | =14.2.0 | |
| TIBCO Spotfire Analyst | =14.3.0 | |
| TIBCO Spotfire Analyst | =14.4.0 | |
| TIBCO Spotfire Analyst | =14.4.1 | |
| TIBCO Spotfire Deployment Kit | <14.0.7 | |
| TIBCO Spotfire Deployment Kit | =14.1.0 | |
| TIBCO Spotfire Deployment Kit | =14.2.0 | |
| TIBCO Spotfire Deployment Kit | =14.3.0 | |
| TIBCO Spotfire Deployment Kit | =14.4.0 | |
| TIBCO Spotfire Deployment Kit | =14.4.1 | |
| TIBCO Spotfire Desktop | <14.4.2 | |
| TIBCO Spotfire Analytics Platform | <14.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3115?
CVE-2025-3115 is categorized as a high-severity vulnerability due to its potential to allow code injection and file upload attacks.
How do I fix CVE-2025-3115?
To fix CVE-2025-3115, ensure that you implement strict validation protocols for file uploads and sanitize all user inputs to prevent injection attacks.
What types of attacks are possible with CVE-2025-3115?
CVE-2025-3115 can lead to code injection attacks and unauthorized file execution through insufficient validation during file uploads.
Which software is affected by CVE-2025-3115?
CVE-2025-3115 affects TIBCO Spotfire and its various versions.
How can CVE-2025-3115 impact system security?
The exploitation of CVE-2025-3115 can result in attackers gaining control over impacted systems, leading to data breaches or further exploitation.
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- vendor/spotfire
- canonical/tibco spotfire
- vendor/tibco
- canonical/tibco spotfire enterprise runtime for r
- canonical/tibco spotfire statistics services
- version/tibco spotfire statistics services/14.1.0
- version/tibco spotfire statistics services/14.2.0
- version/tibco spotfire statistics services/14.3.0
- version/tibco spotfire statistics services/14.4.0
- version/tibco spotfire statistics services/14.4.1
- version/tibco spotfire enterprise runtime for r/1.18.0
- version/tibco spotfire enterprise runtime for r/1.19.0
- version/tibco spotfire enterprise runtime for r/1.20.0
- version/tibco spotfire enterprise runtime for r/1.21.0
- version/tibco spotfire enterprise runtime for r/1.21.1
- canonical/tibco spotfire analyst
- version/tibco spotfire analyst/14.1.0
- version/tibco spotfire analyst/14.2.0
- version/tibco spotfire analyst/14.3.0
- version/tibco spotfire analyst/14.4.0
- version/tibco spotfire analyst/14.4.1
- canonical/tibco spotfire deployment kit
- version/tibco spotfire deployment kit/14.1.0
- version/tibco spotfire deployment kit/14.2.0
- version/tibco spotfire deployment kit/14.3.0
- version/tibco spotfire deployment kit/14.4.0
- version/tibco spotfire deployment kit/14.4.1
- canonical/tibco spotfire desktop
- canonical/tibco spotfire analytics platform