CVE-2020-9416high

CVE-2020-9416: high-severity vulnerability in TIBCO Spotfire Analyst

TIBCO Spotfire Stored Cross Site Scripting Vulnerability

Published · Updated

Follow this CVE+ Monitor TIBCO Spotfire Analytics Platform for AWS Marketplace+ Monitor TIBCO Spotfire Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.6%
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Affected products
TIBCO Software Inc. · TIBCO Spotfire AnalystTIBCO Software Inc. · TIBCO Spotfire Analytics Platform for AWS MarketplaceTIBCO Software Inc. · TIBCO Spotfire DesktopTIBCO Software Inc. · TIBCO Spotfire Server
Related CVEs — TIBCO Spotfire Analyst

In the same product, most dangerous first.

CVE-2019-11211CRITICALTIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service Vulnerable To Remote Code ExecutionEPSS 3.7%CVE-2019-11210CRITICALTIBCO Enterprise Runtime for R Server Exposes Remote Code ExecutionEPSS 3.7%CVE-2018-5435CRITICALTIBCO Spotfire Product Family Remote Code Execution VulnerabilityEPSS 3.2%CVE-2018-18814HIGHTIBCO Spotfire Authentication VulnerabilityEPSS 3.1%CVE-2019-11206MEDIUMTIBCO Spotfire Server Vulnerabilities With Integrity of Comments and BookmarksEPSS 1.6%CVE-2018-18813HIGHTIBCO Spotfire Reflected and Persistent Cross-Site Scripting VulnerabilitiesEPSS 1.5%