CVE-2019-11204

published 2019-05-14

CVE-2019-11204: The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an…

Priority P3 49 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
tibco	spotfire_statistics_services	<= 7.11.1	—
tibco	spotfire_statistics_services	—	—
tibco_software_inc	tibco_spotfire_statistics_services	—	—
tibco_software_inc	tibco_spotfire_statistics_services	unspecified – 7.11.1	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 9.9 CRITICAL CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.