CVE-2019-17335

TIBCO Spotfire Server Exposes User-Specific Cached Data To Others Users

State: Published
Severity: 5.3 Medium
Published: Dec 17, 2019
Updated: Sep 16, 2024
Reserved: Oct 7, 2019

Description

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains multiple vulnerabilities that theoretically allow an attacker access to data cached from a data source, or a portion of a data source, that the attacker should not have access to. The attacker would need privileges to save a Spotfire file to the library. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0 and TIBCO Spotfire Server: versions 7.11.7 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.2.1, 10.3.0, 10.3.1, 10.3.2, 10.3.3, and 10.3.4, versions 10.4.0, 10.5.0, and 10.6.0.

Scores

CVSS	Score	Vector	Source
3.0	5.3 Medium	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N	tibco

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
TIBCO Spotfire Analytics Platform for AWS MarketplaceTIBCO Software Inc.	10.6.0Affected
TIBCO Spotfire ServerTIBCO Software Inc.	7.11.7 and earlierAffected 7.12.0Affected 7.13.0Affected 7.14.0Affected 10.0.0Affected 10.0.1Affected 10.1.0Affected 10.2.0Affected 10.2.1Affected 10.3.0Affected 10.3.1Affected 10.3.2Affected 10.3.3Affected 10.3.4Affected 10.4.0Affected 10.5.0Affected 10.6.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.