TIBCO Spotfire Server API Authorization Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO Spotfire Server | up to 10.10.6 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Server | 11.0.0; 11.1.0; 11.2.0; 11.3.0; 11.4.0; 11.4.1 | — | No fix listed | CNA |
| TIBCO | TIBCO Spotfire Server | 11.5.0; 11.6.0 | — | No fix listed | CNA |
- TIBCO Spotfire Server VendorTIBCO Affected up to 10.10.6 Fixed in — No fix listed CNA
- TIBCO Spotfire Server VendorTIBCO Affected 11.0.0; 11.1.0; 11.2.0; 11.3.0; 11.4.0; 11.4.1 Fixed in — No fix listed CNA
- TIBCO Spotfire Server VendorTIBCO Affected 11.5.0; 11.6.0 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* | up to 10.10.6 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:* | 11.0.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:* | 11.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:* | 11.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:* | 11.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.4.0:*:*:*:*:*:*:* | 11.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.4.1:*:*:*:*:*:*:* | 11.4.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.5.0:*:*:*:*:*:*:* | 11.5.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:11.6.0:*:*:*:*:*:*:* | 11.6.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* Versions up to 10.10.6 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.2.0:*:*:*:*:*:*:* Versions 11.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.3.0:*:*:*:*:*:*:* Versions 11.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.4.0:*:*:*:*:*:*:* Versions 11.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.4.1:*:*:*:*:*:*:* Versions 11.4.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.5.0:*:*:*:*:*:*:* Versions 11.5.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:11.6.0:*:*:*:*:*:*:* Versions 11.6.0 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43051
- 2026-10-03 Alias added: GHSA-j7vq-gw7g-j543
References
More TIBCO Spotfire Server vulnerabilities
- TI-2018-13324 TIBCO Spotfire Authentication Vulnerability CVSS 3.0CRITICAL 9.8
- TI-2022-19963 TIBCO Spotfire Stored Cross Site Scripting (XSS) Vulnerability CVSS 3.1CRITICAL 9.0
- TI-2020-07524 TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2019-08383 TIBCO Spotfire Server Exposes Multiple Reflected Cross-Site Scripting Vulnerabilities CVSS 3.0HIGH 8.8
- TI-2018-13323 TIBCO Spotfire Reflected and Persistent Cross-Site Scripting Vulnerabilities CVSS 3.0HIGH 8.8
- TI-2018-03950 TIBCO Spotfire Server information disclosure vulnerabilities CVSS 3.0HIGH 8.8
Sources
- CVE-2021-43051 · CVE Program
- CVE-2021-43051 · NVD
- FIRST EPSS
- GHSA-j7vq-gw7g-j543 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences