CVE-2019-17334

TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files

Severity Score

8.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, and TIBCO Spotfire Desktop Language Packs contains a vulnerability that theoretically allows an attacker with permission to write DXP files to the Spotfire library to remotely execute code of their choice on the user account of other users who access the affected system. This attack is a risk only when the attacker has write access to a network file system shared with the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: version 10.6.0, TIBCO Spotfire Deployment Kit: versions 7.11.1 and below, TIBCO Spotfire Desktop: versions 7.11.1 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1, and 10.3.2, versions 10.4.0, 10.5.0, and 10.6.0, and TIBCO Spotfire Desktop Language Packs: versions 7.11.1 and below.

El componente Visualizations de TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform para AWS Marketplace, TIBCO Spotfire Deployment Kit, TIBCO Spotfire Desktop, y TIBCO Spotfire Desktop Language Packs, contiene una vulnerabilidad que teóricamente permite a un atacante, con permiso para escribir archivos DXP en la biblioteca de Spotfire, ejecutar código remotamente de su elección en la cuenta de usuario de otros usuarios que acceden al sistema afectado. Este ataque es un riesgo solo cuando el atacante tiene acceso de escritura a un sistema de archivos de red compartido con el sistema afectado. Las versiones afectadas son TIBCO Software Inc.'s TIBCO Spotfire Analyst: versiones 7.11.1 y por debajo, versiones 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3 .1 y 10.3.2, versiones 10.4.0, 10.5.0 y 10.6.0, TIBCO Spotfire Analytics Platform para AWS Marketplace: versión 10.6.0, TIBCO Spotfire Deployment Kit: versiones 7.11.1 y por debajo, TIBCO Spotfire Desktop : versiones 7.11.1 y por debajo, versiones 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0, 10.3.1 y 10.3.2, versiones 10.4.0, 10.5.0 y 10.6.0, y TIBCO Spotfire Desktop Language Packs: versiones 7.11.1 y por debajo.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-10-07 CVE Reserved
2019-12-17 CVE Published
2023-03-07 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-276: Incorrect Default Permissions

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.tibco.com/services/support/advisories	2019-12-27
https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17334	2019-12-27

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				<= 7.11.1 Search vendor "Tibco" for product "Spotfire Analyst" and version " <= 7.11.1"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				7.12.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "7.12.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				7.13.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "7.13.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				7.14.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "7.14.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.0.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.0.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.1.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.1.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.2.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.2.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.3.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.3.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.3.1 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.3.1"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.3.2 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.3.2"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.4.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.4.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.5.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.5.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analyst Search vendor "Tibco" for product "Spotfire Analyst"				10.6.0 Search vendor "Tibco" for product "Spotfire Analyst" and version "10.6.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Analytics Platform For Aws Search vendor "Tibco" for product "Spotfire Analytics Platform For Aws"				10.6.0 Search vendor "Tibco" for product "Spotfire Analytics Platform For Aws" and version "10.6.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Deployment Kit Search vendor "Tibco" for product "Spotfire Deployment Kit"				<= 7.11.1 Search vendor "Tibco" for product "Spotfire Deployment Kit" and version " <= 7.11.1"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				<= 7.11.1 Search vendor "Tibco" for product "Spotfire Desktop" and version " <= 7.11.1"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				7.12.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "7.12.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				7.13.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "7.13.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				7.14.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "7.14.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.0.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.0.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.1.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.1.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.2.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.2.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.3.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.3.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.3.1 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.3.1"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.3.2 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.3.2"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.4.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.4.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.5.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.5.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Search vendor "Tibco" for product "Spotfire Desktop"				10.6.0 Search vendor "Tibco" for product "Spotfire Desktop" and version "10.6.0"		-		Affected
Tibco Search vendor "Tibco"		Spotfire Desktop Language Packs Search vendor "Tibco" for product "Spotfire Desktop Language Packs"				<= 7.11.1 Search vendor "Tibco" for product "Spotfire Desktop Language Packs" and version " <= 7.11.1"		-		Affected