CVE-2023-26220

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
TIBCO Software Inc.	Spotfire Analyst	<= 11.4.7; 11.5.0; 11.6.0; 11.7.0; 11.8.0; 12.0.0; 12.0.1; 12.0.2; 12.0.3; 12.0.4; 12.1.0; 12.1.1
TIBCO Software Inc.	Spotfire Server	<= 11.4.11; 11.5.0; 11.6.0; 11.6.1; 11.6.2; 11.6.3; 11.7.0; 11.8.0; 11.8.1; 12.0.0; 12.0.1; 12.0.2; 12.0.3; 12.0.4; 12.0.5; 12.1.0; 12.1.1

References

https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/services/support/advisoriesVendor Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-262213.9The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an e CVE-2023-262225.4The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easi CVE-2023-262269.8A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 CVE-2023-26236.5The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low CVE-2023-262349.8JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.CVE-2023-262356.1JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.CVE-2023-262367.8An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, CVE-2023-262376.7An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYST CVE-2023-262385.5An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted mess CVE-2023-262395.5An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of a password check, it is possible to obtain credentia CVE-2023-26246.1The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl CVE-2023-262427.8afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.