What’s Vulnerable › Vulnerabilities

CVE-2023-26221: TIBCO Spotfire Insufficiently Protected Credential vulnerability

• Severity: low (CVSS 3.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-08 · updated 2026-06-17
• Weakness: CWE-522

Description

The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with read/write access to craft malicious Analyst files. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 12.3.0, 12.4.0, and 12.5.0, Spotfire Server: versions 12.3.0, 12.4.0, and 12.5.0, and Spotfire for AWS Marketplace: version 12.5.0.

Affected products

• TIBCO Spotfire Analyst: 12.3.0, 12.4.0, 12.5.0
• TIBCO Spotfire Analytics Platform: 12.5.0
• TIBCO Software Inc. TIBCO Spotfire Server: 12.3.0, 12.4.0, 12.5.0

References

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/services/support/advisories

Get alerted when CVE-2023-26221 or the next vulnerability affects your stack