Skip to content
CVE PROGRAM SOURCE RECORD9.4 Critical

CVE-2025-3115

Spotfire Data Function Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spotfire Spotfire Statistics Services

Default version status: unaffected

  • 14 to < 14.0.7affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Spotfire Analyst

Default version status: unknown

  • 14.0 to < 14.0.6affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Deployment Kit used in Spotfire Server

Default version status: unknown

  • 14.0 to < 14.0.7affected
  • 14.1.0affected
  • 14.2.0affected
  • 14.3.0affected
  • 14.4.0affected
  • 14.4.1affected

Spotfire Spotfire Desktop

Default version status: unknown

  • 14.4 to < 14.4.2affected

Spotfire Spotfire for AWS Marketplace

Default version status: unknown

  • 14.4 to < 14.4.2unknown

Spotfire Spotfire Enterprise Runtime for R - Server Edition

Default version status: unknown

  • 1.17 to < 1.17.7affected
  • 1.18.0affected
  • 1.19.0affected
  • 1.20.0affected
  • 1.21.0affected
  • 1.21.1affected

Spotfire Spotfire Service for Python

Default version status: unknown

  • 1.17 to < 1.17.7affected
  • 1.18.0 to ≤ 1.21.1affected

Spotfire Spotfire Service for R

Default version status: unknown

  • 1.17 to < 1.17.7affected
  • 1.18.0 to ≤ 1.21.1affected

References