CVE-2019-8988 TIBCO Spotfire Data Science Privilege Escalation Vulnerability
A persistent cross-site scripting vulnerability in TIBCO Data Science allows users to escalate privileges and modify or delete restricted data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-8988?
CVE-2019-8988 is a medium-severity vulnerability in TIBCO Data Science for AWS, published on 26 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The application server component of TIBCO Software Inc.'s TIBCO Data Science for AWS, and TIBCO Spotfire Data Science contains a persistent cross-site contains a vulnerability that theoretically allows a user to escalate their privileges on the affected system, in a way that may allow for data modifications and deletions that should be denied. Affected releases are TIBCO Software Inc.'s TIBCO Data Science for AWS: versions up to and including 6.4.0, and TIBCO Spotfire Data Science: versions up to and including 6.4.0.
Which versions are affected by CVE-2019-8988?
It affects 2 products.
Products include Tibco Data Science for Aws, Tibco Spotfire Data Science.
How do I fix CVE-2019-8988?
No fix has been published for CVE-2019-8988 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-8988 being exploited?
There is no known exploitation of CVE-2019-8988 in the wild and no public exploit code.
Other vulnerabilities in TIBCO Data Science for AWS
Sources
Also known as GHSA-c7rg-76x8-9q88.