CVE Feed

    Dashboard / CVE / CVE-2023-26221

    CVE-2023-26221

    The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.

    Published:Nov 8, 2023
    Last Modified:Nov 21, 2024
    EPS:Nov 8, 2023
    EPSS Score:0.00061
    CVSS Score:5

    Affected Products

    Vendor
    Tibco
    Product
    Spotfire Analyst
    Vendor
    Tibco
    Product
    Spotfire Analytics Platform
    Vendor
    Tibco
    Product
    Spotfire Server

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-3115 (CVSS 9.4) — Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system ex…
    CVE-2023-26220 (CVSS 5.4) — The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easil…
    CVE-2022-41558 (CVSS 9) — The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Sp…
    CVE-2021-23273 (CVSS 8) — The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platfo…
    CVE-2020-9416 (CVSS 8.2) — The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platfo…
    CVE-2019-17334 (CVSS 8) — The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platfor…
    CVE-2017-3181 (CVSS 9.8) — Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to pr…
    CVE-2017-3180 (CVSS 5.4) — Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fail…
    CVE-2018-5435 (CVSS 9.6) — The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotf…
    CVE-2018-5437 (CVSS 6.8) — The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotf…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High