TIBCO Spotfire Windows Platform Installation vulnerability
Priority LOW 37CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.
Why it matters now
EPSS 0.00219 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO Enterprise Runtime for R - Server Edition | up to 1.2.4 | — | No fix listed | CNA |
| TIBCO | TIBCO Enterprise Runtime for R - Server Edition | 1.3.0; 1.3.1 | — | No fix listed | CNA |
| TIBCO | TIBCO Enterprise Runtime for R - Server Edition | 1.4.0; 1.5.0; 1.6.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Analytics Platform for AWS Marketplace | up to 11.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Server | up to 10.3.12 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Server | 10.4.0; 10.5.0; 10.6.0; 10.6.1; 10.7.0; 10.8.0; 10.8.1; 10.9.0; 10.10.0; 10.10.1; 10.10.2; 10.10.3; 10.10.4 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Server | 11.0.0; 11.1.0; 11.2.0; 11.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Statistics Services | up to 10.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Statistics Services | 10.10.0; 10.10.1; 10.10.2 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Statistics Services | 11.1.0; 11.2.0; 11.3.0 | — | No fix listed | CNA |
- TIBCO Enterprise Runtime for R - Server Edition VendorTIBCO Affected up to 1.2.4 Fixed in — No fix listed CNA
- TIBCO Enterprise Runtime for R - Server Edition VendorTIBCO Affected 1.3.0; 1.3.1 Fixed in — No fix listed CNA
- TIBCO Enterprise Runtime for R - Server Edition VendorTIBCO Affected 1.4.0; 1.5.0; 1.6.0 Fixed in — No fix listed CNA
- TIBCO Spotfire Analytics Platform for AWS Marketplace VendorTIBCO Affected up to 11.3.0 Fixed in — No fix listed CNA
- TIBCO Spotfire Server VendorTIBCO Affected up to 10.3.12 Fixed in — No fix listed CNA
- TIBCO Spotfire Server VendorTIBCO Affected 10.4.0; 10.5.0; 10.6.0; 10.6.1; 10.7.0; 10.8.0; 10.8.1; 10.9.0; 10.10.0; 10.10.1; 10.10.2; 10.10.3; 10.10.4 Fixed in — No fix listed CNA
- TIBCO Spotfire Server VendorTIBCO Affected 11.0.0; 11.1.0; 11.2.0; 11.3.0 Fixed in — No fix listed CNA
- TIBCO Spotfire Statistics Services VendorTIBCO Affected up to 10.3.0 Fixed in — No fix listed CNA
- TIBCO Spotfire Statistics Services VendorTIBCO Affected 10.10.0; 10.10.1; 10.10.2 Fixed in — No fix listed CNA
- TIBCO Spotfire Statistics Services VendorTIBCO Affected 11.1.0; 11.2.0; 11.3.0 Fixed in — No fix listed CNA
CPE configurations NVD · 32
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:enterprise_runtime_for_r:*:*:*:*:server:*:*:* | up to 1.2.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.0:*:*:*:server:*:*:* | 1.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.1:*:*:*:server:*:*:* | 1.3.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_runtime_for_r:1.4.0:*:*:*:server:*:*:* | 1.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_runtime_for_r:1.5.0:*:*:*:server:*:*:* | 1.5.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_runtime_for_r:1.6.0:*:*:*:server:*:*:* | 1.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_analytics_platform:*:*:*:*:*:aws_marketplace:*:* | up to 11.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* | up to 10.3.12 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.4.0:*:*:*:*:*:*:* | 10.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.5.0:*:*:*:*:*:*:* | 10.5.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:enterprise_runtime_for_r:*:*:*:*:server:*:*:* Versions up to 1.2.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.0:*:*:*:server:*:*:* Versions 1.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_runtime_for_r:1.3.1:*:*:*:server:*:*:* Versions 1.3.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_runtime_for_r:1.4.0:*:*:*:server:*:*:* Versions 1.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_runtime_for_r:1.5.0:*:*:*:server:*:*:* Versions 1.5.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_runtime_for_r:1.6.0:*:*:*:server:*:*:* Versions 1.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_analytics_platform:*:*:*:*:*:aws_marketplace:*:* Versions up to 11.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* Versions up to 10.3.12 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.4.0:*:*:*:*:*:*:* Versions 10.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·TIBCO
Show 22 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:spotfire_server:10.6.0:*:*:*:*:*:*:* | 10.6.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.6.1:*:*:*:*:*:*:* | 10.6.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:* | 10.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:* | 10.8.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:* | 10.8.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:* | 10.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:* | 10.10.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:* | 10.10.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.10.2:*:*:*:*:*:*:* | 10.10.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.10.3:*:*:*:*:*:*:* | 10.10.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:10.10.4:*:*:*:*:*:*:* | 10.10.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:* | 11.0.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:* | 11.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:* | 11.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:* | up to 10.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:10.10.0:*:*:*:*:*:*:* | 10.10.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:10.10.1:*:*:*:*:*:*:* | 10.10.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:10.10.2:*:*:*:*:*:*:* | 10.10.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:11.1.0:*:*:*:*:*:*:* | 11.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:11.2.0:*:*:*:*:*:*:* | 11.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_statistics_services:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:spotfire_server:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.6.1:*:*:*:*:*:*:* Versions 10.6.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.7.0:*:*:*:*:*:*:* Versions 10.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.8.0:*:*:*:*:*:*:* Versions 10.8.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.8.1:*:*:*:*:*:*:* Versions 10.8.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.9.0:*:*:*:*:*:*:* Versions 10.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.10.0:*:*:*:*:*:*:* Versions 10.10.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.10.1:*:*:*:*:*:*:* Versions 10.10.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.10.2:*:*:*:*:*:*:* Versions 10.10.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.10.3:*:*:*:*:*:*:* Versions 10.10.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:10.10.4:*:*:*:*:*:*:* Versions 10.10.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:* Versions up to 10.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:10.10.0:*:*:*:*:*:*:* Versions 10.10.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:10.10.1:*:*:*:*:*:*:* Versions 10.10.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:10.10.2:*:*:*:*:*:*:* Versions 10.10.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_statistics_services:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23275
- 2026-10-03 Alias added: GHSA-vm2c-v328-xcwc
References
More TIBCO Enterprise Runtime For R vulnerabilities
- TI-2019-08389 TIBCO Enterprise Runtime for R Server Running On Linux With Containerized TERR Service… CVSS 3.1CRITICAL 9.9
- TI-2019-08388 TIBCO Enterprise Runtime for R Server Exposes Remote Code Execution CVSS 3.1CRITICAL 10.0
- TI-2021-09821 TIBCO Spotfire Windows Platform Artifact Search vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2021-23275 · CVE Program
- CVE-2021-23275 · NVD
- FIRST EPSS
- GHSA-vm2c-v328-xcwc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences