#VU23653 Information disclosure in TIBCO Spotfire Server and TIBCO Spotfire for AWS - CVE-2019-17336

Vulnerability identifier: #VU23653

Vulnerability risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-17336

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TIBCO Spotfire Server
Server applications / Other server solutions
TIBCO Spotfire for AWS
Server applications / Other server solutions

Vendor: TIBCO

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Data access layer component exposes credentials for shared data sources. A remote authenticated attacker can gain access to information that can lead to obtaining credentials used to access Spotfire data sources.

To successful exploitation of this vulnerability the attacker would need privileges to save a Spotfire file to the library, and only applies in a situation where NTLM credentials, or a credentials profile is in use.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

TIBCO Spotfire Server: 7.0.0 - 10.6.0

TIBCO Spotfire for AWS: 10.6.0

---

External links
https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2019/12/tibco-security-advisory-december-17-2019-tibco-spotfire-2019-17336

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.