جزئیات آسیب‌پذیری
CVE-2025-3115
Spotfire Deployment Kit used in Spotfire ServerSpotfire AnalystSpotfire DesktopSpotfire Enterprise Runtime for RSpotfire Service for PythonSpotfire Service for R
Spotfire Data Function Vulnerability
CVSS 4.0
9.4بحرانی
شرح رسمی (انگلیسی)
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.4بحرانی | 4.0 | CVEProject cvelistV5 (CNA) (tibco) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Spotfire | Deployment Kit used in Spotfire Server | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Deployment Kit used in Spotfire Server | 14.0 ≤ v < 14.0.7 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Analyst | 14.0 ≤ v < 14.0.6 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Desktop | 14.4 ≤ v < 14.4.2 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.18.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.19.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.20.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.21.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.21.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Enterprise Runtime for R - Server Edition | 1.17 ≤ v < 1.17.7 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Service for Python | 1.17 ≤ v < 1.17.7 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Service for Python | 1.18.0 ≤ v ≤ 1.21.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Service for R | 1.17 ≤ v < 1.17.7 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Service for R | 1.18.0 ≤ v ≤ 1.21.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.1.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.2.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.3.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.4.0 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14.4.1 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire Statistics Services | 14 ≤ v < 14.0.7 | CVEProject cvelistV5 (CNA) |
| Spotfire | Spotfire for AWS Marketplace | 14.4 ≤ v < 14.4.2 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۱/۲۰
- آخرین به‌روزرسانی
- ۱۴۰۴/۰۸/۲۰
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- tibco
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶۸٪
احتمال بهره‌برداری در ۳۰ روز
۵۲٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')