CVE-2022-30579 — Server-Side Request Forgery in Software INC Tibco Spotfire Analytics Platform FOR AWS Marketplace

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
8.4HIGHNVD
CNA7.1
EPSS
0.2%
top 51.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Tibco Software INC Tibco Spotfire Analytics Platform FOR AWS MarketplaceTibco Software INC Tibco Spotfire ServerTibco Spotfire Analytics Platform+1 more
Timeline
PublishedSep 20
Latest updateSep 21

Description

The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:LExploitability: 1.8 | Impact: 6.0

Affected Packages4 packages

🔴Vulnerability Details

2
GHSA
GHSA-3j96-4r54-mhqg: The Web Player component of TIBCO Software Inc↗2022-09-21
▶
CVEList
TIBCO Spotfire Server Blind SSRF vulnerability↗2022-09-20
▶
CVE-2022-30579 — Server-Side Request Forgery | cvebase