Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2017-3181— Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query

Quick assessment

Affected
TIBCO Spotfire Analyst
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TIBCO Spotfire Analyst等都是美国TIBCO软件公司的产品。Spotfire Analyst是一套数据分析和挖掘平台；Spotfire Desktop是一套专为探索数据设计的分析软件。 多款TIBCO产品中存在多个SQL注入漏洞，该漏洞源于程序在使用SQL语句查询之前，没有正确的过滤用户提交的输入。远程攻击者可利用该漏洞控制应用程序，访问或修改数据或利用底层数据库中的潜在漏洞。以下产品和版本受到影响：TIBCO Spotfire Analyst 7.7.0版本；TIBCO Spotfi

AI Predicted 8.5 Difficulty: Easy EPSS 1.48% · P72
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-3181

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. The following products and versions are affected: TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 The following components are affected: TIBCO Spotfire Client TIBCO Spotfire Web Player Client
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
多款TIBCO产品SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
TIBCO Spotfire Analyst等都是美国TIBCO软件公司的产品。Spotfire Analyst是一套数据分析和挖掘平台；Spotfire Desktop是一套专为探索数据设计的分析软件。 多款TIBCO产品中存在多个SQL注入漏洞，该漏洞源于程序在使用SQL语句查询之前，没有正确的过滤用户提交的输入。远程攻击者可利用该漏洞控制应用程序，访问或修改数据或利用底层数据库中的潜在漏洞。以下产品和版本受到影响：TIBCO Spotfire Analyst 7.7.0版本；TIBCO Spotfi
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
TIBCO Spotfire Analyst 7.7.0 -
TIBCO Spotfire Connectors 7.6.0 -
TIBCO Spotfire Deployment Kit 7.7.0 -
TIBCO Spotfire Desktop 7.6.0 -
TIBCO Spotfire Desktop Developer Edition 7.7.0 -
TIBCO Spotfire Desktop Language Packs 7.6.0 -
TIBCO Spotfire Web Player Client N/A -
TIBCO Spotfire Client N/A -

II. Public POCs for CVE-2017-3181

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-3181

请登录查看更多情报信息。

Vendor Advisories for CVE-2017-3181 (1)

Other References for CVE-2017-3181 (1)

IV. Related Vulnerabilities

Same product: Spotfire Analyst
Same vendor: TIBCO
Same weakness: CWE-89

V. Comments for CVE-2017-3181

No comments yet

Leave a comment