CVE-2018-12410: TIBCO Spotfire Statistics Services remote execution vulnerabilities

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-10 · updated 2026-06-17

Description

The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.

Affected products

TIBCO Software Inc. TIBCO Spotfire Statistics Services: through 7.11.0

References

http://www.securityfocus.com/bid/105558
https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics
http://www.securityfocus.com/bid/105558
https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics

Get alerted when CVE-2018-12410 or the next vulnerability affects your stack