CVE-2018-12410 TIBCO Spotfire Statistics Services remote execution vulnerabilities

Critical 9.8 Published 10 Oct 2018 Updated 16 Sep 2024

Unauthenticated attackers can remotely execute code with system account privileges on TIBCO Spotfire Statistics Services web servers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-12410?

CVE-2018-12410 is a critical code injection vulnerability in TIBCO Spotfire Statistics Services, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.

Which versions are affected by CVE-2018-12410?

It affects 1 product.

Products include Tibco Spotfire Statistics Services.

How do I fix CVE-2018-12410?

No fix has been published for CVE-2018-12410 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-12410 being exploited?

There is no known exploitation of CVE-2018-12410 in the wild and no public exploit code.

Sources

Also known as GHSA-w4j9-r5c2-rr9w.