Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context o
Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other…
| Vendor | Product | Versions |
|---|---|---|
| TIBCO | Silver Fabric Enabler for Spotfire Web Player | 2.1.2 |
| TIBCO | Spotfire Analyst | 7.5.0, 7.6.0, 7.7.0 |
| TIBCO | Spotfire Analytics Platform for AWS Marketplace | 7.0.2 |
| TIBCO | Spotfire Automation Services 6 | 7.0.0, 7.0.1, 6.5.3 |
| TIBCO | Spotfire Connectors | 7.6.0 |
| TIBCO | Spotfire Deployment Kit | 7.0.0, 7.0.1, 7.5.0, 7.6.0, 7.7.0, 6.5.3 |
| TIBCO | Spotfire Desktop | 7.0.0, 7.0.1, 7.5.0, 7.6.0, 7.7.0, 6.5.2 |
| TIBCO | Spotfire Desktop Developer Edition | 7.7.0 |
| TIBCO | Spotfire Desktop Language Packs | 7.5.0, 7.6.0, 7.7.0, 7.0.1 |
| TIBCO | Spotfire Professional | 7.0.0, 7.0.1, 6.5.3 |
| TIBCO | Spotfire Web Player | 7.0.0, 7.0.1, 6.5.3 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.