CVE-2025-3115

tibco spotfire enterprise runtime for r, tibco spotfire statistics services, tibco spotfire analyst +3 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-3115

Katalog CVE

CVSS 9.8 · Critical EPSS 0,68%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada tibco spotfire enterprise runtime for r, tibco spotfire statistics services +4 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution

Rincian

Terbit di NVD
9 April 2025
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-94: Improper Control of Generation of Code ('Code Injection')
EPSS (30 hari)
0,68% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
tibco spotfire enterprise runtime for r Semua versi sebelum 6.1.5
tibco spotfire statistics services Semua versi sebelum 14.0.7
tibco spotfire statistics services Versi 14.1.0
tibco spotfire statistics services Versi 14.2.0
tibco spotfire statistics services Versi 14.3.0
tibco spotfire statistics services Versi 14.4.0
tibco spotfire statistics services Versi 14.4.1
tibco spotfire enterprise runtime for r Semua versi sebelum 1.17.7
tibco spotfire enterprise runtime for r Versi 1.18.0
tibco spotfire enterprise runtime for r Versi 1.19.0
tibco spotfire enterprise runtime for r Versi 1.20.0
tibco spotfire enterprise runtime for r Versi 1.21.0
tibco spotfire enterprise runtime for r Versi 1.21.1
tibco spotfire analyst Semua versi sebelum 14.0.6
tibco spotfire analyst Versi 14.1.0
tibco spotfire analyst Versi 14.2.0
tibco spotfire analyst Versi 14.3.0
tibco spotfire analyst Versi 14.4.0
tibco spotfire analyst Versi 14.4.1
tibco spotfire deployment kit Semua versi sebelum 14.0.7
tibco spotfire deployment kit Versi 14.1.0
tibco spotfire deployment kit Versi 14.2.0
tibco spotfire deployment kit Versi 14.3.0
tibco spotfire deployment kit Versi 14.4.0
tibco spotfire deployment kit Versi 14.4.1
tibco spotfire desktop Semua versi sebelum 14.4.2
tibco spotfire analytics platform Semua versi sebelum 14.4.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.