CVE-2023-29268

26.04.2023, 18:15

The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
tibco	CNA	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 77%

Vendor	Product	Version
tibco	spotfire_statistics_services	𝑥 < 11.4.11
tibco	spotfire_statistics_services	11.5.0
tibco	spotfire_statistics_services	11.6.0
tibco	spotfire_statistics_services	11.6.1
tibco	spotfire_statistics_services	11.6.2
tibco	spotfire_statistics_services	11.7.0
tibco	spotfire_statistics_services	11.8.0
tibco	spotfire_statistics_services	11.8.1
tibco	spotfire_statistics_services	12.0.0
tibco	spotfire_statistics_services	12.0.1
tibco	spotfire_statistics_services	12.0.2
tibco	spotfire_statistics_services	12.1.0
tibco	spotfire_statistics_services	12.2.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-434 - Unrestricted Upload of File with Dangerous Type
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

References

https://www.tibco.com/services/support/advisories