Riskcovery

CVE-2025-3114

Spotfire Code Execution Vulnerability

State
Published
Severity
9.4 Critical
Published
Apr 9, 2025
Updated
Apr 15, 2025
Reserved
Apr 2, 2025

Read the record on cve.org

Description

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.

Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.

Scores

CVSSScoreVectorSource
4.09.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Htibco

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')
  • CWE-693 Protection Mechanism Failure

Affected Products

ProductVersions
Spotfire Enterprise Runtime for RSpotfire
  • 6 through 1.4Affected
Spotfire Statistics ServicesSpotfire
  • 14 through 0.6Affected
  • 14.1.0Affected
  • 14.2.0Affected
  • 14.3.0Affected
  • 14.4.0Affected
  • 14.4.1Affected
Spotfire AnalystSpotfire
  • 14 through 0.5Affected
  • 14.1.0Affected
  • 14.2.0Affected
  • 14.3.0Affected
  • 14.4.0Affected
  • 14.4.1Affected
Deployment Kit used in Spotfire ServerSpotfire
  • 14 through 0.6Affected
  • 14.1.0Affected
  • 14.2.0Affected
  • 14.3.0Affected
  • 14.4.0Affected
  • 14.4.1Affected
Spotfire DesktopSpotfire
  • 14 through 4.1Affected
Spotfire for AWS MarketplaceSpotfire
  • 14 through 4.1Unknown
Spotfire Enterprise Runtime for R - Server EditionSpotfire
  • 1 through 17.6Affected
  • 1.18.0Affected
  • 1.19.0Affected
  • 1.20.0Affected
  • 1.21.0Affected
  • 1.21.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.