جزئیات آسیب‌پذیری
CVE-2025-3114
Spotfire Deployment Kit used in Spotfire ServerSpotfire AnalystSpotfire DesktopSpotfire Enterprise Runtime for RSpotfire Statistics ServicesSpotfire for AWS Marketplace
Spotfire Code Execution Vulnerability
CVSS 4.0
9.4بحرانی
شرح رسمی (انگلیسی)
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.4بحرانی | 4.0 | CVEProject cvelistV5 (CNA) (tibco) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Spotfire | Deployment Kit used in Spotfire Server | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14 ≤ v ≤ 0.6 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14 ≤ v ≤ 0.5 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Desktop | 14 ≤ v ≤ 4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R | 6 ≤ v ≤ 1.4 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.18.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.19.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.20.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.21.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.21.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1 ≤ v ≤ 17.6 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14 ≤ v ≤ 0.6 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire for AWS Marketplace | 14 ≤ v ≤ 4.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۱/۲۰
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۱/۲۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- tibco
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶٪
احتمال بهره‌برداری در ۳۰ روز
۴۹٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-693Protection Mechanism Failure