← Vulnerability feed

Vulnerability record · CVE-2023-26220 · published 10 October 2023

CVE-2023-26220: Tibco spotfire analyst cross-site scripting vulnerability

Tibco · Spotfire Analyst

The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.

5.4 CVSS 3.1 Medium EPSS 0.34% · top 74.1% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s Spotfire Analyst: versions 11.4.7 and below, versions 11.5.0, 11.6.0, 11.7.0, 11.8.0, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4, versions 12.1.0 and 12.1.1 and Spotfire Server: versions 11.4.11 and below, versions 11.5.0, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.7.0, 11.8.0, 11.8.1, 12.0.0, 12.0.1, 12.0.2, 12.0.3, 12.0.4, and 12.0.5, versions 12.1.0 and 12.1.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tibco.com/services/support/advisories Vendor Advisory
https://www.tibco.com/services/support/advisories Vendor Advisory

Track CVE-2023-26220 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-18814Tibco spotfire analytics platform for aws improper authentication vulnerabilityThe TIBCO Spotfire authentication component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server…EPSS 3.1%9.8CVE-2017-3181Tibco spotfire analyst sql injection vulnerabilityMultiple TIBCO Products are prone to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input bef…EPSS 1.7%9.8CVE-2018-5435Tibco spotfire analyst vulnerabilityThe TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics P…EPSS 3.2%9.4CVE-2025-3115Tibco spotfire enterprise runtime for r code injection vulnerabilityInjection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, …EPSS 0.68%8.8CVE-2020-9408Tibco spotfire analytics platform for aws incorrect default permissions vulnerabilityThe Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vu…EPSS 1.3%8.8CVE-2018-5437Tibco spotfire analyst vulnerabilityThe TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics P…EPSS 0.93%8.8CVE-2018-5436Tibco spotfire analytics platform for aws information exposure vulnerabilityThe Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multi…EPSS 1.0%8.4CVE-2022-30579Tibco spotfire analytics platform server-side request forgery (ssrf) vulnerabilityThe Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficul…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2023-26220), CISA KEV, FIRST EPSS (scores of 2026-10-11). This page is refreshed as NVD updates the record.