CVE-2022-30579

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Sep 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-30588.8Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific CVE-2022-305807.8Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named eithe CVE-2022-305848.8Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potent CVE-2022-305856.5The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious CVE-2022-305867.2Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.CVE-2022-305877.5Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.CVE-2022-30597.5The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Du CVE-2022-305917.5quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QU CVE-2022-305929.8liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.CVE-2022-305947.8The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions o CVE-2022-305959.8libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.CVE-2022-305965.4A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent