CVEvulnerability

CVE-2025-3115

9.4 CRITICAL Published 2025-04-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-04-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.4 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Affected configurations

• tibco spotfire enterprise runtime for r (< 6.1.5) • tibco spotfire statistics services (< 14.0.7) • tibco spotfire statistics services 14.1.0 • tibco spotfire statistics services 14.2.0 • tibco spotfire statistics services 14.3.0 • tibco spotfire statistics services 14.4.0 • tibco spotfire statistics services 14.4.1 • tibco spotfire enterprise runtime for r (< 1.17.7) • tibco spotfire enterprise runtime for r 1.18.0 • tibco spotfire enterprise runtime for r 1.19.0 • tibco spotfire enterprise runtime for r 1.20.0 • tibco spotfire enterprise runtime for r 1.21.0 • tibco spotfire enterprise runtime for r 1.21.1 • tibco spotfire analyst (< 14.0.6) • tibco spotfire analyst 14.1.0 • tibco spotfire analyst 14.2.0 • tibco spotfire analyst 14.3.0 • tibco spotfire analyst 14.4.0 • tibco spotfire analyst 14.4.1 • tibco spotfire deployment kit (< 14.0.7) • tibco spotfire deployment kit 14.1.0 • tibco spotfire deployment kit 14.2.0 • tibco spotfire deployment kit 14.3.0 • tibco spotfire deployment kit 14.4.0 • tibco spotfire deployment kit 14.4.1 • tibco spotfire desktop (< 14.4.2) • tibco spotfire analytics platform (< 14.4.2)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References