CVE-2019-11210 - The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and T

CVE-2019-11210

Summary

The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and remotely execute code using the operating system account hosting the affected component. This issue affects: TIBCO Enterprise Runtime for R - Server Edition versions 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.4.0 and 10.5.0.

References

Vulnerable Configurations

cpe:2.3:a:tibco:enterprise_runtime_for_r:-:*:*:*:server:*:*:*
cpe:2.3:a:tibco:enterprise_runtime_for_r:-:*:*:*:server:*:*:*
cpe:2.3:a:tibco:enterprise_runtime_for_r:1.1.0:*:*:*:server:*:*:*
cpe:2.3:a:tibco:enterprise_runtime_for_r:1.1.0:*:*:*:server:*:*:*
cpe:2.3:a:tibco:enterprise_runtime_for_r:1.2.0:*:*:*:server:*:*:*
cpe:2.3:a:tibco:enterprise_runtime_for_r:1.2.0:*:*:*:server:*:*:*
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.4.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.4.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.5.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:10.5.0:*:*:*:*:*:*:*

CVSS

Base:	10.0 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:N/C:C/I:C/A:C

refmap via4

confirm	https://www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2019-tibco-enterprise-runtime-for-r-server-2019-11210
misc	http://www.tibco.com/services/support/advisories

Last major update

24-08-2020 - 17:37

Published

18-09-2019 - 23:15

Last modified

24-08-2020 - 17:37