Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2025-3114

Spotfire Code Execution Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spotfire Spotfire Enterprise Runtime for R

Default version status: unaffected

  • 6 to ≤ 1.4affected

Spotfire Spotfire Statistics Services

Default version status: unaffected

  • 14 to ≤ 0.6affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Spotfire Analyst

Default version status: unknown

  • 14 to ≤ 0.5affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Deployment Kit used in Spotfire Server

Default version status: unknown

  • 14 to ≤ 0.6affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Spotfire Desktop

Default version status: unaffected

  • 14 to ≤ 4.1affected

Spotfire Spotfire for AWS Marketplace

Default version status: unknown

  • 14 to ≤ 4.1unknown

Spotfire Spotfire Enterprise Runtime for R - Server Edition

Default version status: unknown

  • 1 to ≤ 17.6affected
  • 1.18.0affected
  • 1.19.0affected
  • 1.20.0affected
  • 1.21.0affected
  • 1.21.1affected

References