{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-29268", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "state": "PUBLISHED", "assignerShortName": "tibco", "dateReserved": "2023-04-04T19:06:51.372Z", "datePublished": "2023-04-26T17:24:18.689Z", "dateUpdated": "2024-08-02T14:00:16.019Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "TIBCO Spotfire Statistics Services", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "11.4.10", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "affected", "version": "11.5.0"}, {"status": "affected", "version": "11.6.0"}, {"status": "affected", "version": "11.6.1"}, {"status": "affected", "version": "11.6.2"}, {"status": "affected", "version": "11.7.0"}, {"status": "affected", "version": "11.8.0"}, {"status": "affected", "version": "11.8.1"}, {"status": "affected", "version": "12.0.0"}, {"status": "affected", "version": "12.0.1"}, {"status": "affected", "version": "12.0.2"}, {"status": "affected", "version": "12.1.0"}, {"status": "affected", "version": "12.2.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.</p>"}], "value": "The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Uploaded or modified files may be executed within the scope of the web server process allowing access to the system.", "lang": "en"}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2023-04-26T17:24:18.689Z"}, "references": [{"url": "https://www.tibco.com/services/support/advisories"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>TIBCO has released updated versions of the affected components which address these issues.</p><p>TIBCO Spotfire Statistics Services versions 11.4.10 and below: update to version 11.4.11 or later</p><p>TIBCO Spotfire Statistics Services versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2: update to version 12.0.3 or later</p><p>TIBCO Spotfire Statistics Services versions 12.1.0 and 12.2.0: update to version 12.3.0 or later</p>"}], "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO Spotfire Statistics Services versions 11.4.10 and below: update to version 11.4.11 or later\n\nTIBCO Spotfire Statistics Services versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2: update to version 12.0.3 or later\n\nTIBCO Spotfire Statistics Services versions 12.1.0 and 12.2.0: update to version 12.3.0 or later\n\n"}], "source": {"discovery": "INTERNAL"}, "title": "TIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:00:16.019Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.tibco.com/services/support/advisories", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:*", "matchCriteriaId": "65804033-AECA-41EC-8973-CAE190EF69BD", "versionEndExcluding": "11.4.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "1D37E7A0-F21A-413E-AF65-59340520B6C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "4F3602DE-B5AB-4FFA-AAD9-8C42B00988F9", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "510E83A5-B777-4EE6-851C-F9BE10147594", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "55EABB66-4B3D-4D72-B028-E40491CDC77C", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "42A74F6C-267D-4B1F-BF66-A1F10B0B2A9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "2C677EA4-6EB9-4B9B-9E1E-97555AF1291F", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:11.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "DE304915-AE5B-45C7-BA5C-79AA880F1088", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D69CD443-28E2-4632-95D4-E5EB3F094768", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:12.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "4EAE9787-53AE-4A38-8223-1F7893CC3CEE", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:12.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "C3ECA9B9-6058-4CE5-9535-8ED98022FB74", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:12.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "3E78843D-BBB8-4558-9E56-75CE514FA143", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:spotfire_statistics_services:12.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "CA10C631-566D-46BF-93A5-A7A92266FC47", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that allows an unauthenticated remote attacker to upload or modify arbitrary files within the web server directory on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions 11.4.10 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, and 12.0.2, versions 12.1.0 and 12.2.0.\n\n"}], "id": "CVE-2023-29268", "lastModified": "2024-11-21T07:56:46.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@tibco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-26T18:15:09.160", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}