CVE-2019-11204
TIBCO Spotfire Statistics Services Exposes Sensitive Files
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.0 | Critical9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 26% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.
Weakness
- The impact of this vulnerability includes the theoretical possibility that credentials to both the Spotfire Statistics Services server, and to other systems could be exposed.
Affected products
TIBCO Software Inc. · TIBCO Spotfire Statistics Services
- affected unspecified – ≤ 7.11.1
- affected 10.0.0
What to do
Solution: TIBCO has released updated versions of the affected components which address these issues. TIBCO Spotfire Statistics Services versions 7.11.1 and below update to version 7.11.2 or higher TIBCO Spotfire Statistics Services version 10.0.0 update to 10.0.1 or higher
References (3)
- http://www.tibco.com/services/support/advisories (opens in a new tab)x_refsource_MISCx_transferred
- https://www.tibco.com/support/advisories/2019/05/tibco-security-advisory-may-14-2019-tibco-spotfire-statistics-services-2019-11204 (opens in a new tab)x_refsource_MISCx_transferred
- 108347 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-11204)Record last updated .