Multiple vulnerabilities in TIBCO Software



Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-28830
CVE-2021-23275
CWE-ID CWE-284
Exploitation vector Local
Public exploit N/A
Vulnerable software
 TIBCO Enterprise Runtime for R - Server Edition
Server applications / Other server solutions

TIBCO Spotfire for AWS
Server applications / Other server solutions

TIBCO Spotfire Server
Server applications / Other server solutions

TIBCO Spotfire Statistics Services
Server applications / Other server solutions

Vendor TIBCO

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU54472

Risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-28830

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components search for run-time artifacts outside of the installation hierarchy. A local user can insert malicious software and gain full access to the Windows operating system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

TIBCO Enterprise Runtime for R - Server Edition: 1.2.4 - 1.6.0

TIBCO Spotfire for AWS: 11.3.0

TIBCO Spotfire Server: 10.3.12 - 11.3.0

TIBCO Spotfire Statistics Services: 10.3.0 - 11.3.0

CPE2.3 External links

https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire-2021-28830


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU54474

Risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2021-23275

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to a lack of access restrictions on certain files and/or folders in the installation within the Windows Installation component. A local user can insert malicious software and gain full access to the Windows operating system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

TIBCO Enterprise Runtime for R - Server Edition: 1.2.4 - 1.6.0

TIBCO Spotfire for AWS: 11.3.0

TIBCO Spotfire Server: 10.3.12 - 11.3.0

TIBCO Spotfire Statistics Services: 10.3.0 - 11.3.0

CPE2.3 External links

https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2021/06/tibco-security-advisory-june-29-2021-tibco-spotfire...


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###