Spotfire Remote Code Execution Vulnerability
Priority MEDIUM 44CWE-250Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.
Summary
Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In the case of the installed Windows client: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code.This requires human interaction from a person other than the attacker., In the case of the Web player (Business Author): Successful execution of this vulnerability via the Web Player, will result in the attacker being able to run arbitrary code as the account running the Web player process, In the case of Automation Services: Successful execution of this vulnerability will result in an attacker being able to run arbitrary code via Automation Services..This issue affects Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0 through 14.0.2; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0 through 14.0.3, from 14.2.0 through 14.3.0; Spotfire for AWS Marketplace: from 14.0 before 14.3.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00587 48th percentileScored 2026-11-07
Fix Fixed Spotfire for AWS Marketplace (Spotfire): 14.3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Spotfire | Spotfire Analyst | 12.0.9 – 12.5.0; 14.0 – 14.0.2 | — | No fix listed | CNA |
| Spotfire | Spotfire Server | 12.0.10 – 12.5.0; 14.0 – 14.0.3; 14.2.0 – 14.3.0 | — | No fix listed | CNA |
| Spotfire | Spotfire for AWS Marketplace | 14.0 to before 14.3.0 | 14.3.0 | Patch available | CNA |
- Spotfire Analyst VendorSpotfire Affected 12.0.9 – 12.5.0; 14.0 – 14.0.2 Fixed in — No fix listed CNA
- Spotfire Server VendorSpotfire Affected 12.0.10 – 12.5.0; 14.0 – 14.0.3; 14.2.0 – 14.3.0 Fixed in — No fix listed CNA
- Spotfire for AWS Marketplace VendorSpotfire Affected 14.0 to before 14.3.0 Fixed in 14.3.0 Patch available CNA
CPE names CISA-ADP · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:* | 12.1.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:* | 12.1.1 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:* | 12.2.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:* | 12.3.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:* | 12.4.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:* | 12.5.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:* | 14.0.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:* | 14.0.1 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:* | 14.0.2 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:* | 14.1.0 | — | TIBCO |
- cpe:2.3:a:tibco:spotfire_analyst:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:14.0.1:*:*:*:*:*:*:* Versions 14.0.1 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:14.0.2:*:*:*:*:*:*:* Versions 14.0.2 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:14.1.0:*:*:*:*:*:*:* Versions 14.1.0 — ·TIBCO
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:* | 14.2.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:* | 14.3.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:* | 12.1.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:* | 12.1.1 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:* | 12.2.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:* | 12.3.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:* | 12.4.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:* | 12.5.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:* | 14.0.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:* | 14.0.1 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:* | 14.0.2 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:* | 14.0.3 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:* | 14.2.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:* | 14.3.0 | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:* | not specified by CISA-ADP | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:* | — | — | TIBCO |
| cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* | — | — | TIBCO |
- cpe:2.3:a:tibco:spotfire_analyst:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.1.1:*:*:*:*:*:*:* Versions 12.1.1 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:12.5.0:*:*:*:*:*:*:* Versions 12.5.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.0.0:*:*:*:*:*:*:* Versions 14.0.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.0.1:*:*:*:*:*:*:* Versions 14.0.1 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.0.2:*:*:*:*:*:*:* Versions 14.0.2 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.0.3:*:*:*:*:*:*:* Versions 14.0.3 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analytics_platform_for_aws:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·TIBCO
- cpe:2.3:a:tibco:spotfire_analyst:*:*:*:*:*:*:*:* Versions — — ·TIBCO
- cpe:2.3:a:tibco:spotfire_server:*:*:*:*:*:*:*:* Versions — — ·TIBCO
Remediation
- Fix · CNA Spotfire for AWS Marketplace (Spotfire) Fixed in 14.3.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3330
- 2026-10-03 Alias added: GHSA-65p7-vc93-6p69
References
More Spotfire vulnerabilities
- TI-2025-02719 Spotfire Code Execution Vulnerability CVSS 4.0CRITICAL 9.4
- TI-2026-07549 Spotfire OAuth2 PKCE Bypass for public clients CVSS 4.0HIGH 8.7
- TI-2024-03118 Spotfire: NTLM token leakage CVSS 3.1MEDIUM 6.8
Sources
- CVE-2024-3330 · CVE Program
- CVE-2024-3330 · NVD
- FIRST EPSS
- GHSA-65p7-vc93-6p69 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences