CVE-2019-8989

TIBCO Spotfire Data Science Spoofing Vulnerability

Description

The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a vulnerability that theoretically enables a user to spoof their account to look like a different user in the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.

Remediation

Solution:

TIBCO has released updated versions of the affected systems which address these issues. TIBCO Data Science for AWS versions 6.4.0 and below upgrade to version 6.4.1 or higher TIBCO Spotfire Data Science versions 6.4.0 and below upgrade to version 6.4.1 or higher

4.3

CVSS

Severity: Medium

CVSS 3.1 •

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.21%

Vendor Advisory tibco.com Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO Data Science for AWS

Affected: TIBCO Software Inc. TIBCO Spotfire Data Science

References

Link	Tags
http://www.tibco.com/services/support/advisories	vendor advisory
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-26-2019-tibco-spotfire-data-science-2019-8989	vendor advisory
http://www.securityfocus.com/bid/107608	vdb entry third party advisory

Frequently Asked Questions

What is the severity of CVE-2019-8989?: CVE-2019-8989 has been scored as a medium severity vulnerability.
How to fix CVE-2019-8989?: To fix CVE-2019-8989: TIBCO has released updated versions of the affected systems which address these issues. TIBCO Data Science for AWS versions 6.4.0 and below upgrade to version 6.4.1 or higher TIBCO Spotfire Data Science versions 6.4.0 and below upgrade to version 6.4.1 or higher
Is CVE-2019-8989 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-8989 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-8989?: CVE-2019-8989 affects TIBCO Software Inc. TIBCO Data Science for AWS, TIBCO Software Inc. TIBCO Spotfire Data Science.