by Kastro
Paper/Archive/CVE-2023-29268

CVE-2023-29268

TIBCO Software Inc. TIBCO Spotfire Statistics Services — TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.8.638 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.

Affected

ProductAffectedFixed inSource
TIBCO Spotfire Statistics Services≤ 11.4.10–CNA
TIBCO Spotfire Statistics Services11.5.0–CNA
TIBCO Spotfire Statistics Services11.6.0–CNA
TIBCO Spotfire Statistics Services11.6.1–CNA
TIBCO Spotfire Statistics Services11.6.2–CNA
TIBCO Spotfire Statistics Services11.7.0–CNA
TIBCO Spotfire Statistics Services11.8.0–CNA
TIBCO Spotfire Statistics Services11.8.1–CNA
TIBCO Spotfire Statistics Services12.0.0–CNA
TIBCO Spotfire Statistics Services12.0.1–CNA
TIBCO Spotfire Statistics Services12.0.2–CNA
TIBCO Spotfire Statistics Services12.1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
tibco (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftibco.com/services/support/advisories