2 lines
5.6 KiB
JSON
2 lines
5.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Spotfire Enterprise Runtime for R","vendor":"Spotfire","versions":[{"lessThanOrEqual":"1.4","status":"affected","version":"6","versionType":"Patch"}]},{"defaultStatus":"unaffected","product":"Spotfire Statistics Services","vendor":"Spotfire","versions":[{"lessThanOrEqual":"0.6","status":"affected","version":"14","versionType":"Patch"},{"status":"affected","version":"14.1.0"},{"status":"affected","version":"14.2.0"},{"status":"affected","version":"14.3.0"},{"status":"affected","version":"14.4.0"},{"status":"affected","version":"14.4.1"}]},{"defaultStatus":"unknown","product":"Spotfire Analyst","vendor":"Spotfire","versions":[{"lessThanOrEqual":"0.5","status":"affected","version":"14","versionType":"Patch"},{"status":"affected","version":"14.1.0","versionType":"Patch"},{"status":"affected","version":"14.2.0","versionType":"Patch"},{"status":"affected","version":"14.3.0","versionType":"Patch"},{"status":"affected","version":"14.4.0","versionType":"Patch"},{"status":"affected","version":"14.4.1","versionType":"Patch"}]},{"defaultStatus":"unknown","product":"Deployment Kit used in Spotfire Server","vendor":"Spotfire","versions":[{"lessThanOrEqual":"0.6","status":"affected","version":"14","versionType":"Patch"},{"status":"affected","version":"14.1.0","versionType":"Patch"},{"status":"affected","version":"14.2.0","versionType":"Patch"},{"status":"affected","version":"14.3.0","versionType":"Patch"},{"status":"affected","version":"14.4.0","versionType":"Patch"},{"status":"affected","version":"14.4.1","versionType":"Patch"}]},{"defaultStatus":"unaffected","product":"Spotfire Desktop","vendor":"Spotfire","versions":[{"lessThanOrEqual":"4.1","status":"affected","version":"14","versionType":"Patch"}]},{"defaultStatus":"unknown","product":"Spotfire for AWS Marketplace","vendor":"Spotfire","versions":[{"lessThanOrEqual":"4.1","status":"unknown","version":"14","versionType":"Patch"}]},{"defaultStatus":"unknown","product":"Spotfire Enterprise Runtime for R - Server Edition","vendor":"Spotfire","versions":[{"lessThanOrEqual":"17.6","status":"affected","version":"1","versionType":"Patch"},{"status":"affected","version":"1.18.0","versionType":"Patch"},{"status":"affected","version":"1.19.0","versionType":"Patch"},{"status":"affected","version":"1.20.0","versionType":"Patch"},{"status":"affected","version":"1.21.0","versionType":"Patch"},{"status":"affected","version":"1.21.1","versionType":"Patch"}]}],"source":"security@tibco.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls."},{"lang":"es","value":"Ejecución de código mediante archivos maliciosos: Los atacantes pueden crear archivos especialmente manipulados con código incrustado que puede ejecutarse sin la validación de seguridad adecuada, lo que podría comprometer el sistema. Vulnerabilidad de elusión de la zona de pruebas: Una falla en el mecanismo de seguridad TERR permite a los atacantes eludir las restricciones de la zona de pruebas, lo que permite la ejecución de código no confiable sin los controles adecuados."}],"id":"CVE-2025-3114","lastModified":"2026-06-17T09:19:12.500","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security@tibco.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3114","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-04-09T18:03:07.615805Z","version":"2.0.3"}}]},"published":"2025-04-09T18:15:50.643","references":[{"source":"security@tibco.com","url":"https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"}],"sourceIdentifier":"security@tibco.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-693"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|