CVE-2023-29268

TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability

State: Published
Severity: 9.8 Critical
Published: Apr 26, 2023
Updated: Jan 30, 2025
Reserved: Apr 4, 2023

Description

The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	tibco

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
TIBCO Spotfire Statistics ServicesTIBCO Software Inc.	11.4.10 and earlierAffected 11.5.0Affected 11.6.0Affected 11.6.1Affected 11.6.2Affected 11.7.0Affected 11.8.0Affected 11.8.1Affected 12.0.0Affected 12.0.1Affected 12.0.2Affected 12.1.0Affected 12.2.0Affected

References

https://www.tibco.com/services/support/advisories

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.