CVE-2020-9408 — Incorrect Default Permissions in Software INC Tibco Spotfire Analytics Platform FOR AWS Marketplace

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 52.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Tibco Software INC Tibco Spotfire Analytics Platform FOR AWS MarketplaceTibco Software INC Tibco Spotfire ServerTibco Spotfire Analytics Platform FOR AWS+1 more
Timeline
PublishedMar 11
Latest updateMay 24

Description

The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into e…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5tibco_software_inc/tibco_spotfire_serverunspecified — 7.11.9+20
▶NVDtibco/spotfire_server7.11.9+20

🔴Vulnerability Details

2
GHSA
GHSA-xh75-j2qv-65qf: The Spotfire library component of TIBCO Software Inc↗2022-05-24
▶
CVEList
TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability↗2020-03-11
▶
CVE-2020-9408 — Incorrect Default Permissions | cvebase