CVE-2019-8988

TIBCO Spotfire Data Science Privilege Escalation Vulnerability

Description

The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected system, in a way that may allow for data modifications and deletions that should be denied. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.

Remediation

Solution:

TIBCO has released updated versions of the affected systems which address these issues. TIBCO Data Science for AWS versions 6.4.0 and below upgrade to version 6.4.1 or higher TIBCO Spotfire Data Science versions 6.4.0 and below upgrade to version 6.4.1 or higher

8.1

CVSS

Severity: High

CVSS 3.1 •

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.40%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO Data Science for AWS

Affected: TIBCO Software Inc. TIBCO Spotfire Data Science

References

Link	Tags
http://www.tibco.com/services/support/advisories	vendor advisory
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8988	vendor advisory
http://www.securityfocus.com/bid/107593	vdb entry third party advisory broken link

Frequently Asked Questions

What is the severity of CVE-2019-8988?: CVE-2019-8988 has been scored as a high severity vulnerability.
How to fix CVE-2019-8988?: To fix CVE-2019-8988: TIBCO has released updated versions of the affected systems which address these issues. TIBCO Data Science for AWS versions 6.4.0 and below upgrade to version 6.4.1 or higher TIBCO Spotfire Data Science versions 6.4.0 and below upgrade to version 6.4.1 or higher
Is CVE-2019-8988 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-8988 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-8988?: CVE-2019-8988 affects TIBCO Software Inc. TIBCO Data Science for AWS, TIBCO Software Inc. TIBCO Spotfire Data Science.