CVE-2019-11205 — Cross-site Scripting in Software INC Tibco Spotfire Analytics Platform FOR AWS Marketplace

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
CNA8.8
EPSS
0.5%
top 35.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Tibco Software INC Tibco Spotfire Analytics Platform FOR AWS MarketplaceTibco Software INC Tibco Spotfire ServerTibco Spotfire Analytics Platform FOR AWS+1 more
Timeline
PublishedMay 14
Latest updateMay 24

Description

The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDtibco/spotfire_server5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-c4r2-c7vr-q2c9: The web server component of TIBCO Software Inc↗2022-05-24
▶
CVEList
TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities↗2019-05-14
▶
CVE-2019-11205 — Cross-site Scripting | cvebase