CVE-2019-11210: critical vulnerability in TIBCO Enterprise Runtime for R - Server Edition
TIBCO Enterprise Runtime for R Server Exposes Remote Code Execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TIBCO Enterprise Runtime for R Server has a critical flaw that lets anyone, without logging in, run malicious code on the server using the account that runs the application. This could give attackers complete control of the system.
An unauthenticated remote attacker can bypass access controls on TIBCO Enterprise Runtime for R - Server Edition (≤1.2.0) and TIBCO Spotfire Analytics Platform for AWS Marketplace (10.4.0, 10.5.0) to achieve arbitrary code execution with privileges of the hosting OS account. The vulnerability requires network access to the affected service but no prior credentials or user interaction.
In the same product, most dangerous first.