TI-2024-03118 Aliases CVE-2024-3331 GHSA-frr7-vm5q-h4f9

Spotfire: NTLM token leakage

LOW 30CWE-863Published 2024-06-27 · Updated 2026-03-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spotfire Spotfire Analyst, Spotfire Spotfire Desktop, Spotfire Spotfire Server allows The impact of this vulnerability depends on the privileges of the user running the affected software..This issue affects Spotfire Enterprise Runtime for R - Server Edition: from 1.12.7 through 1.20.0; Spotfire Statistics Services: from 12.0.7 through 12.3.1, from 14.0.0 through 14.3.0; Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0.0 through 14.3.0; Spotfire Desktop: from 14.0 through 14.3.0; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0.0 through 14.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00377 31st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Spotfire	Spotfire Enterprise Runtime for R - Server Edition	1.12.7 – 1.20.0	—	No fix listed	CNA
Spotfire	Spotfire Statistics Services	12.0.7 – 12.3.1; 14.0.0 – 14.3.0	—	No fix listed	CNA
Spotfire	Spotfire Analyst	12.0.9 – 12.5.0; 14.0.0 – 14.3.0	—	No fix listed	CNA
Spotfire	Spotfire Desktop	14.0 – 14.3.0	—	No fix listed	CNA
Spotfire	Spotfire Server	12.0.10 – 12.5.0; 14.0.0 – 14.3.0	—	No fix listed	CNA

Spotfire Enterprise Runtime for R - Server Edition VendorSpotfire Affected 1.12.7 – 1.20.0 Fixed in — No fix listed CNA
Spotfire Statistics Services VendorSpotfire Affected 12.0.7 – 12.3.1; 14.0.0 – 14.3.0 Fixed in — No fix listed CNA
Spotfire Analyst VendorSpotfire Affected 12.0.9 – 12.5.0; 14.0.0 – 14.3.0 Fixed in — No fix listed CNA
Spotfire Desktop VendorSpotfire Affected 14.0 – 14.3.0 Fixed in — No fix listed CNA
Spotfire Server VendorSpotfire Affected 12.0.10 – 12.5.0; 14.0.0 – 14.3.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-3331
2026-10-03 Alias added: GHSA-frr7-vm5q-h4f9

References

Other 1

https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3331-r3436/

TI-2024-03117 Spotfire Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
TI-2025-02719 Spotfire Code Execution Vulnerability CVSS 4.0CRITICAL 9.4
TI-2026-07549 Spotfire OAuth2 PKCE Bypass for public clients CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences