CVE-2018-18813

The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/106635	Third Party Advisory VDB Entry
http://www.tibco.com/services/support/advisories	Vendor Advisory
https://www.tibco.com/support/advisories/2019/01/tibco-security-advisory-january-16-2019-tibco-spotfire-2018-18813	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws::::::::
	cpe:2.3:a:tibco:spotfire_server::::::::
	cpe:2.3:a:tibco:spotfire_server:7.11.0:::::::*
	cpe:2.3:a:tibco:spotfire_server:7.11.1:::::::*
	cpe:2.3:a:tibco:spotfire_server:7.12.0:::::::*
	cpe:2.3:a:tibco:spotfire_server:7.13.0:::::::*
	cpe:2.3:a:tibco:spotfire_server:7.14.0:::::::*
	cpe:2.3:a:tibco:spotfire_server:10.0.0:::::::*

History

No history.

Information

Published : 2019-01-16 22:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-18813

Mitre link : CVE-2018-18813

CVE.ORG link : CVE-2018-18813

JSON object : View

Products Affected

tibco

spotfire_analytics_platform_for_aws
spotfire_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2018-18813", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@tibco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-01-16T22:29:00.310", "references": [{"url": "http://www.securityfocus.com/bid/106635", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@tibco.com"}, {"url": "http://www.tibco.com/services/support/advisories", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}, {"url": "https://www.tibco.com/support/advisories/2019/01/tibco-security-advisory-january-16-2019-tibco-spotfire-2018-18813", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Spotfire web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains multiple vulnerabilities that may allow persistent and reflected cross-site scripting attacks. Affected releases are TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.0.0, and TIBCO Spotfire Server: versions up to and including 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0; 10.0.0."}, {"lang": "es", "value": "El componente del servidor web Spotfire de TIBCO Spotfire Analytics Platform for AWS Marketplace y TIBCO Spotfire Server, de TIBCO Software Inc., contiene m\u00faltiples vulnerabilidades que podr\u00edan permitir ataques de Componente persistente y reflejado. Las versiones afectadas de los productos de TIBCO Software Inc.son TIBCO Spotfire Analytics Platform for AWS Marketplace: versiones hasta e incluyendo la 10.0.0 y TIBCO Spotfire Server: versiones hasta e incluyendo las 7.10.1; 7.11.0; 7.11.1; 7.12.0; 7.13.0; 7.14.0 y la 10.0.0."}], "lastModified": "2019-10-09T23:37:26.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1D10198-A17E-432F-BEB4-F98A8A067839", "versionEndIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA796C00-8493-40A3-BE34-3B5703194E7A", "versionEndIncluding": "7.10.1"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:7.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F60AE38F-9603-47B1-9451-6A9B9D8FC065"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:7.11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08AE8942-B051-4142-BFAE-5D47B883B7A7"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:7.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F59A46F-9E34-4354-AB7D-73A253014BA9"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:7.13.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97B691A6-B273-4880-AD61-53169C4C3CEC"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:7.14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47E57AE2-D98C-4231-9E56-A5EE8B5BC0AF"}, {"criteria": "cpe:2.3:a:tibco:spotfire_server:10.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "933FA68E-688B-40E6-A49B-952C3CC7123C"}], "operator": "OR"}]}], "sourceIdentifier": "security@tibco.com"}