CVE-2018-18814high

CVE-2018-18814: high-severity vulnerability in TIBCO Spotfire Analytics Platform for AWS…

TIBCO Spotfire Authentication Vulnerability

Published · Updated

Follow this CVE+ Monitor TIBCO Spotfire Analytics Platform for AWS Marketplace+ Monitor TIBCO Spotfire Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 3.1%
In short

TIBCO Spotfire has a flaw in how it checks user login credentials, allowing attackers to bypass authentication and gain unauthorized access to user accounts regardless of what security settings are configured.

Technical detail

The authentication component in TIBCO Spotfire Analytics Platform for AWS Marketplace (≤10.0.0) and TIBCO Spotfire Server (≤7.14.0) fails to properly validate credentials, enabling attackers to circumvent authentication mechanisms and achieve full account compromise. The vulnerability is authentication-agnostic, affecting accounts regardless of configured security policies.

Summary generated and translated by AI from the official description.
The TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability in the handling of the authentication that theoretically may allow an attacker to gain full access to a target account, independent of configured authentication mechanisms. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
TIBCO Software Inc. · TIBCO Spotfire Analytics Platform for AWS MarketplaceTIBCO Software Inc. · TIBCO Spotfire Server
Related CVEs — TIBCO Spotfire Analytics Platform for AWS…

In the same product, most dangerous first.

CVE-2019-11211CRITICALTIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code ExecutionEPSS 3.7%CVE-2019-11210CRITICALTIBCO Enterprise Runtime for R Server Exposes Remote Code ExecutionEPSS 3.7%CVE-2018-5435CRITICALTIBCO Spotfire Product Family Remote Code Execution VulnerabilityEPSS 3.2%CVE-2019-11206MEDIUMTIBCO Spotfire Server Vulnerabilities With Integrity of Comments and BookmarksEPSS 1.6%CVE-2018-18813HIGHTIBCO Spotfire Reflected and Persistent Cross-Site Scripting VulnerabilitiesEPSS 1.5%CVE-2020-9408CRITICALTIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution VulnerabilityEPSS 1.3%