CVE-2018-12410 TIBCO Spotfire Statistics Services remote execution vulnerabilities

CriticalCVSS 9.8 EPSS 4.0%

Published: 2018-10-10 23:00
Updated: 2026-06-17 04:37
Exploit status: No public exploit known

Description

The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.

Affected products

Product	Affected versions	Fixed in
tibco spotfire statistics services	<= 7.11.0	No fix listed
TIBCO Software Inc. TIBCO Spotfire Statistics Services	<= 7.11.0	No fix listed

References

105558 third-party-advisory vdb-entry
www.tibco.com third-party-advisory

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (4)

v3.0 9.8 · tibco
v3.0 9.8 · nvd@nist.gov
v3.0 9.8 · security@tibco.com
v2.0 7.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 3.97% (percentile 90.6)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.