CVE-2018-12410
TIBCO Spotfire Statistics Services remote execution vulnerabilities
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 4.0% · top 9.5% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- The impact of this vulnerability includes the theoretical possibility of unrestricted remote access to the operating system account hosting the web server component.
Affected products
TIBCO Software Inc. · TIBCO Spotfire Statistics Services
- affected unspecified – ≤ 7.11.0
What to do
Solution: TIBCO has released updated versions of the affected components which address these issues. In addition to the updates, security related configuration changes may be required due to new defaults. Please review the documentation. For each affected system, update to the corresponding software versions: - TIBCO Spotfire Statistics Services versions 7.11.0 and below update to version 7.11.1 or higher
References (2)
- 105558 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-12410)Record last updated .