CVE-2017-3181

Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.securityfocus.com/bid/95696	Third Party Advisory VDB Entry
https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181	Vendor Advisory
https://www.securityfocus.com/bid/95696	Third Party Advisory VDB Entry
https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:tibco:spotfire_analyst:7.7.0:::::::*
	cpe:2.3:a:tibco:spotfire_client:-:::::::*
	cpe:2.3:a:tibco:spotfire_connectors:7.6.0:::::::*
	cpe:2.3:a:tibco:spotfire_deployment_kit:7.7.0:::::::*
	cpe:2.3:a:tibco:spotfire_desktop:7.6.0:::::::*
	cpe:2.3:a:tibco:spotfire_desktop:7.7.0:::::::*
	cpe:2.3:a:tibco:spotfire_desktop:7.7.0::::developer:::
	cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.6.0:::::::*
	cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.7.0:::::::*
	cpe:2.3:a:tibco:spotfire_web_player_client:-:::::::*

History

21 Nov 2024, 03:24

Type	Values Removed	Values Added
References	~~() https://www.securityfocus.com/bid/95696 - Third Party Advisory, VDB Entry~~	() https://www.securityfocus.com/bid/95696 - Third Party Advisory, VDB Entry
References	~~() https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181 - Vendor Advisory~~	() https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181 - Vendor Advisory

Information

Published : 2018-07-24 15:29

Updated : 2024-11-21 03:24

NVD link : CVE-2017-3181

Mitre link : CVE-2017-3181

CVE.ORG link : CVE-2017-3181

JSON object : View

Products Affected

tibco

spotfire_analyst
spotfire_client
spotfire_deployment_kit
spotfire_connectors
spotfire_web_player_client
spotfire_desktop_language_packs
spotfire_desktop

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2017-3181", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-07-24T15:29:00.373", "references": [{"url": "https://www.securityfocus.com/bid/95696", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "https://www.securityfocus.com/bid/95696", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.tibco.com/support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3181", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client"}, {"lang": "es", "value": "M\u00faltiples productos TIBCO son propensos a m\u00faltiples vulnerabilidades sin especificar de inyecci\u00f3n SQL debido a que fracasan a la hora de sanear entradas proporcionadas por el usuario antes de emplearlas en una consulta SQL. La explotaci\u00f3n de estos problemas podr\u00eda permitir que un atacante comprometa la aplicaci\u00f3n, acceda o modifique datos o explote vulnerabilidades latentes en la base de datos subyacente. Los siguientes productos y versiones se han visto afectados: TIBCO Spotfire Analyst 7.7.0; TIBCO Spotfire Connectors 7.6.0; TIBCO Spotfire Deployment Kit 7.7.0; TIBCO Spotfire Desktop 7.6.0; TIBCO Spotfire Desktop 7.7.0; TIBCO Spotfire Desktop Developer Edition 7.7.0; TIBCO Spotfire Desktop Language Packs 7.6.0; y TIBCO Spotfire Desktop Language Packs 7.7.0. Los siguientes componentes se han visto afectados: TIBCO Spotfire Client y TIBCO Spotfire Web Player Client."}], "lastModified": "2024-11-21T03:24:58.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:spotfire_analyst:7.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBD36D84-B44B-48AA-9FD0-966DFBE5CFB5"}, {"criteria": "cpe:2.3:a:tibco:spotfire_client:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08E5094B-61AD-4DF2-A3FF-4BCE872B4032"}, {"criteria": "cpe:2.3:a:tibco:spotfire_connectors:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3DE55C07-E141-4DEA-A9E2-B075E1F56449"}, {"criteria": "cpe:2.3:a:tibco:spotfire_deployment_kit:7.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11E31011-0D3C-4339-86F0-81CD77BC3439"}, {"criteria": "cpe:2.3:a:tibco:spotfire_desktop:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12851913-2BAF-4B35-AD03-7C6B4A91C43E"}, {"criteria": "cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12EF48FC-2634-4D66-8BD2-CB6D3CA04C78"}, {"criteria": "cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:developer:*:*:*", "vulnerable": true, "matchCriteriaId": "CA0557E9-5277-4D60-A1C6-1DC24FD7ECE9"}, {"criteria": "cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4FF6CF3-B05C-4014-83F5-3C44D09F4FC1"}, {"criteria": "cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30D9DCB1-D307-42D0-A5CB-904D5DCCCD91"}, {"criteria": "cpe:2.3:a:tibco:spotfire_web_player_client:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E2BBAD2-C1EB-4698-A598-1AF7A58B94D0"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}

9.8 /10