CVE-2018-5436 TIBCO Spotfire Server information disclosure vulnerabilities

What is CVE-2018-5436?

CVE-2018-5436 is a medium-severity vulnerability in TIBCO Spotfire Analytics Platform for AWS Marketplace, published on 27 Jun 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulnerabilities that may allow for the disclosure of information, including user and data source credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 7.12.0, TIBCO Spotfire Server: versions up to and including 7.8.1; 7.9.0; 7.10.0; 7.11.0; 7.12.0.

Weakness: CWE-200

Which versions are affected by CVE-2018-5436?

It affects 2 products.

Products include Tibco Spotfire Analytics Platform for Aws, Tibco Spotfire Server.

How do I fix CVE-2018-5436?

No fix has been published for CVE-2018-5436 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-5436 being exploited?

There is no known exploitation of CVE-2018-5436 in the wild and no public exploit code.

Other vulnerabilities in TIBCO Spotfire Analytics Platform for AWS Marketplace

• CVE-2020-9408 TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability Critical 9.9
• CVE-2019-11205 TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities High 8.8
• CVE-2018-18813 TIBCO Spotfire Reflected and Persistent Cross-Site Scripting Vulnerabilities High 8.8
• CVE-2018-18814 TIBCO Spotfire Authentication Vulnerability High 8.8
• CVE-2019-17337 TIBCO Spotfire Server Library Vulnerable to Reflected Cross-Site Scripting High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3xc7-x46v-p5qp.