SQL injection in TIBCO Spotfire Analyst
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | Spotfire Analyst | 7.7.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Connectors | 7.6.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Deployment Kit | 7.7.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Desktop | 7.6.0; 7.7.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Desktop Developer Edition | 7.7.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Desktop Language Packs | 7.6.0; 7.7.0 | — | No fix listed | CNA |
| TIBCO | Spotfire Web Player Client | — | — | No fix listed | CNA |
| TIBCO | Spotfire Client | — | — | No fix listed | CNA |
- Spotfire Analyst VendorTIBCO Affected 7.7.0 Fixed in — No fix listed CNA
- Spotfire Connectors VendorTIBCO Affected 7.6.0 Fixed in — No fix listed CNA
- Spotfire Deployment Kit VendorTIBCO Affected 7.7.0 Fixed in — No fix listed CNA
- Spotfire Desktop VendorTIBCO Affected 7.6.0; 7.7.0 Fixed in — No fix listed CNA
- Spotfire Desktop Developer Edition VendorTIBCO Affected 7.7.0 Fixed in — No fix listed CNA
- Spotfire Desktop Language Packs VendorTIBCO Affected 7.6.0; 7.7.0 Fixed in — No fix listed CNA
- Spotfire Web Player Client VendorTIBCO Affected — Fixed in — No fix listed CNA
- Spotfire Client VendorTIBCO Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:spotfire_analyst:7.7.0:*:*:*:*:*:*:* | 7.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_client:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_connectors:7.6.0:*:*:*:*:*:*:* | 7.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_deployment_kit:7.7.0:*:*:*:*:*:*:* | 7.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_desktop:7.6.0:*:*:*:*:*:*:* | 7.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:*:*:*:* | 7.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:developer:*:*:* | 7.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.6.0:*:*:*:*:*:*:* | 7.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.7.0:*:*:*:*:*:*:* | 7.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_web_player_client:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:spotfire_analyst:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_connectors:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_deployment_kit:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_desktop:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_desktop:7.7.0:*:*:*:developer:*:*:* Versions 7.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_desktop_language_packs:7.7.0:*:*:*:*:*:*:* Versions 7.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_web_player_client:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3181
- 2026-10-03 Alias added: GHSA-gxcx-xp38-vxx9
References
More TIBCO Spotfire Analyst vulnerabilities
- TI-2018-03949 TIBCO Spotfire Product Family Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2025-02720 Spotfire Data Function Vulnerability CVSS 4.0CRITICAL 9.4
- TI-2022-19963 TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability CVSS 3.1CRITICAL 9.0
- TI-2018-03951 TIBCO Spotfire Product Family Information Disclosure Vulnerability CVSS 3.0HIGH 8.8
- TI-2015-03831 Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player… CVSS 2.0HIGH 7.5
- TI-2019-12932 TIBCO Spotfire Analyst and Desktop Remote Code Execution Via Shared Files CVSS 3.1HIGH 8.0
Sources
- CVE-2017-3181 · CVE Program
- CVE-2017-3181 · NVD
- FIRST EPSS
- GHSA-gxcx-xp38-vxx9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences