CVE-2024-3331
Spotfire: NTLM token leakage
Severity Score
6.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spotfire Spotfire Analyst, Spotfire Spotfire Desktop, Spotfire Spotfire Server allows The impact of this vulnerability depends on the privileges of the user running the affected software..This issue affects Spotfire Enterprise Runtime for R - Server Edition: from 1.12.7 through 1.20.0; Spotfire Statistics Services: from 12.0.7 through 12.3.1, from 14.0.0 through 14.3.0; Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0.0 through 14.3.0; Spotfire Desktop: from 14.0 through 14.3.0; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0.0 through 14.3.0.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-04 CVE Reserved
- 2024-06-27 CVE Published
- 2024-06-28 EPSS Updated
- 2024-10-29 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-863: Incorrect Authorization
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3331-r3436 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Spotfire Search vendor "Spotfire" | Spotfire Enterprise Runtime For R - Server Edition Search vendor "Spotfire" for product "Spotfire Enterprise Runtime For R - Server Edition" | >= 1.12.7 <= 1.20.0 Search vendor "Spotfire" for product "Spotfire Enterprise Runtime For R - Server Edition" and version " >= 1.12.7 <= 1.20.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Statistics Services Search vendor "Spotfire" for product "Spotfire Statistics Services" | >= 12.0.7 <= 12.3.1 Search vendor "Spotfire" for product "Spotfire Statistics Services" and version " >= 12.0.7 <= 12.3.1" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Statistics Services Search vendor "Spotfire" for product "Spotfire Statistics Services" | >= 14.0.0 <= 14.3.0 Search vendor "Spotfire" for product "Spotfire Statistics Services" and version " >= 14.0.0 <= 14.3.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Analyst Search vendor "Spotfire" for product "Spotfire Analyst" | >= 12.0.9 <= 12.5.0 Search vendor "Spotfire" for product "Spotfire Analyst" and version " >= 12.0.9 <= 12.5.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Analyst Search vendor "Spotfire" for product "Spotfire Analyst" | >= 14.0.0 <= 14.3.0 Search vendor "Spotfire" for product "Spotfire Analyst" and version " >= 14.0.0 <= 14.3.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Desktop Search vendor "Spotfire" for product "Spotfire Desktop" | >= 14.0.0 <= 14.3.0 Search vendor "Spotfire" for product "Spotfire Desktop" and version " >= 14.0.0 <= 14.3.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Server Search vendor "Spotfire" for product "Spotfire Server" | >= 12.0.10 <= 12.5.0 Search vendor "Spotfire" for product "Spotfire Server" and version " >= 12.0.10 <= 12.5.0" | en |
Affected
| ||||||
| Spotfire Search vendor "Spotfire" | Spotfire Server Search vendor "Spotfire" for product "Spotfire Server" | >= 14.0.0 <= 14.3.0 Search vendor "Spotfire" for product "Spotfire Server" and version " >= 14.0.0 <= 14.3.0" | en |
Affected
| ||||||