CVE-2019-11206

TIBCO Spotfire Server Vulnerabilities With Integrity of Comments and Bookmarks

Description

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0.

Remediation

Solution:

TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.2.0 and below update to 10.3.0 or higher TIBCO Spotfire Server versions 7.11.2 and below update to 7.11.3 or higher TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, and 10.2.0 update to 10.2.1 or higher

5.3

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.28%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace

Affected: TIBCO Software Inc. TIBCO Spotfire Server

References

Link	Tags
http://www.tibco.com/services/support/advisories	vendor advisory
https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-server-2019-11206	vendor advisory
http://www.securityfocus.com/bid/108405	broken link third party advisory vdb entry

Frequently Asked Questions

What is the severity of CVE-2019-11206?: CVE-2019-11206 has been scored as a medium severity vulnerability.
How to fix CVE-2019-11206?: To fix CVE-2019-11206: TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.2.0 and below update to 10.3.0 or higher TIBCO Spotfire Server versions 7.11.2 and below update to 7.11.3 or higher TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, and 10.2.0 update to 10.2.1 or higher
Is CVE-2019-11206 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-11206 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-11206?: CVE-2019-11206 affects TIBCO Software Inc. TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Software Inc. TIBCO Spotfire Server.