by Kastro
Paper/Archive/CVE-2025-3115

CVE-2025-3115

Spotfire Spotfire Statistics Services — Spotfire Data Function Vulnerability

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Affected

ProductAffectedFixed inSource
Spotfire Statistics Services14 – < 14.0.714.0.7CNA
Spotfire Statistics Services14.1.0–CNA
Spotfire Statistics Services14.2.0–CNA
Spotfire Statistics Services14.3.0–CNA
Spotfire Statistics Services14.4.0–CNA
Spotfire Statistics Services14.4.1–CNA
Spotfire Analyst14.0 – < 14.0.614.0.6CNA
Spotfire Analyst14.1.0–CNA
Spotfire Analyst14.2.0–CNA
Spotfire Analyst14.3.0–CNA
Spotfire Analyst14.4.0–CNA
Spotfire Analyst14.4.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
tibco (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcommunity.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485