CVE-2018-18812

moderate-risk
Published 2019-01-16

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the Spotfire Library is configured to use external storage. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace versions up to and including 10.0.0, and TIBCO Spotfire Server versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.

Do I need to act?

-
0.15% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (8)

Spotfire Analytics Platform For Aws

Affected Vendors

Tibco

References (6)

Third Party Advisory http://www.securityfocus.com/bid/106635
Vendor Advisory http://www.tibco.com/services/support/advisories
Vendor Advisory https://www.tibco.com/support/advisories/2019/01/tibco-security-advisory-january...
Third Party Advisory http://www.securityfocus.com/bid/106635
Vendor Advisory http://www.tibco.com/services/support/advisories
Vendor Advisory https://www.tibco.com/support/advisories/2019/01/tibco-security-advisory-january...
39
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 1/34 · Minimal
Exposure 14/34 · Moderate