CVE-2023-26220 TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability
A low-privileged attacker can inject malicious scripts into the Spotfire Library, potentially compromising user sessions or data upon interaction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-26220?
CVE-2023-26220 is a medium-severity cross-site scripting vulnerability in TIBCO Software Inc. Spotfire Analyst, published on 10 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.
Weakness: CWE-79
Which versions are affected by CVE-2023-26220?
It affects 2 products.
Products include Tibco Spotfire Analyst, Tibco Spotfire Server.
How do I fix CVE-2023-26220?
No fix has been published for CVE-2023-26220 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-26220 being exploited?
There is no known exploitation of CVE-2023-26220 in the wild and no public exploit code.
Other vulnerabilities in TIBCO Software Inc. Spotfire Analyst
- CVE-2017-3181 SQL injection in Spotfire Analyst
- CVE-2018-5435 TIBCO Spotfire Product Family Remote Code Execution Vulnerability
- CVE-2025-3115 Spotfire Data Function Vulnerability
- CVE-2022-41558 TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability
- CVE-2020-9416 TIBCO Spotfire Stored Cross Site Scripting Vulnerability
Sources
Also known as GHSA-p4rg-7c2h-6cqp.