CVE-2017-3181: Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
TIBCO · Spotfire Analyst
Affected: TIBCO Spotfire Analyst · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 77% of scored CVEs
Not scored yet. The CVE record carries no CVSS score.
DescriptionCVE.org
Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
Affected products8
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- TIBCO · Spotfire Analyst7.7.0
- TIBCO · Spotfire Connectors7.6.0
- TIBCO · Spotfire Deployment Kit7.7.0
- TIBCO · Spotfire Desktop7.6.0; 7.7.0
- TIBCO · Spotfire Desktop Developer Edition7.7.0
- TIBCO · Spotfire Desktop Language Packs7.6.0; 7.7.0
- TIBCO · Spotfire Web Player ClientVersions not stated
- TIBCO · Spotfire ClientVersions not stated
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- SQL Injection
- Vendor
- TIBCO
- Published
- July 2018
CoverageNo articles yet
No CyberSIXT article names CVE-2017-3181 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.