CVE-2018-18812 — Incorrect Permission Assignment in Software INC Tibco Spotfire Analytics Platform FOR AWS Marketplace

CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
5.3MEDIUMNVD
CNA6.5
EPSS
0.1%
top 65.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Tibco Software INC Tibco Spotfire Analytics Platform FOR AWS MarketplaceTibco Software INC Tibco Spotfire Server VersionsTibco Spotfire Analytics Platform FOR AWS+1 more
Timeline
PublishedJan 16
Latest updateMay 13

Description

The Spotfire Library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains a vulnerability that might theoretically fail to restrict users with read-only access from modifying files stored in the Spotfire Library, only when the Spotfire Library is configured to use external storage. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace versions up to and including 10.0.0, and TIBCO …

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5tibco_software_inc/tibco_spotfire_server_versionsunspecified — 7.10.1+6
▶NVDtibco/spotfire_server7.10.1+6

🔴Vulnerability Details

2
GHSA
GHSA-hx95-mp9p-369r: The Spotfire Library component of TIBCO Software Inc↗2022-05-13
▶
CVEList
TIBCO Spotfire Fails To Prevent Write Access to Spotfire Library↗2019-01-16
▶
CVE-2018-18812 — Incorrect Permission Assignment | cvebase