CVE-2017-3180 — Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting

Back Back to CVE browser

MEDIUM

Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting

Published Jul 24, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 0.61%

Description

Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The products and versions that are affected include the following: TIBCO Silver Fabric Enabler for Spotfire Web Player 2.1.2 and earlier TIBCO Spotfire Analyst 7.5.0 TIBCO Spotfire Analyst 7.6.0 TIBCO Spotfire Analyst 7.7.0 TIBCO Spotfire Analytics Platform for AWS Marketplace 7.0.2 and earlier TIBCO Spotfire Automation Services 6.5.3 and earlier TIBCO Spotfire Automation Services 7.0.0, and 7.0.1 TIBCO Spotfire Connectors 7.6.0 TIBCO Spotfire Deployment Kit 6.5.3 and earlier TIBCO Spotfire Deployment Kit 7.0.0, and 7.0.1 TIBCO Spotfire Deployment Kit 7.5.0 TIBCO Spotfire Deployment Kit 7.6.0 TIBCO Spotfire Deployment Kit 7.7.0 TIBCO Spotfire Desktop 6.5.2 and earlier TIBCO Spotfire Desktop 7.0.0, and 7.0.1 TIBCO Spotfire Desktop 7.5.0 TIBCO Spotfire Desktop 7.6.0 TIBCO Spotfire Desktop 7.7.0 TIBCO Spotfire Desktop Developer Edition 7.7.0 TIBCO Spotfire Desktop Language Packs 7.0.1 and earlier TIBCO Spotfire Desktop Language Packs 7.5.0 TIBCO Spotfire Desktop Language Packs 7.6.0 TIBCO Spotfire Desktop Language Packs 7.7.0 TIBCO Spotfire Professional 6.5.3 and earlier TIBCO Spotfire Professional 7.0.0 and 7.0.1 TIBCO Spotfire Web Player 6.5.3 and earlier TIBCO Spotfire Web Player 7.0.0 and 7.0.1

Affected products

Vendor Tibco Product Silver Fabric Enabler for Spotfire Web Player Default
n/a
- Version
  2.1.2
  Status
  affected
  Constraints
  <=2.1.2
Vendor Tibco Product Spotfire Analyst Default
n/a
- Version
  7.5.0
  Status
  affected
  Constraints
  -
- Version
  7.6.0
  Status
  affected
  Constraints
  -
- Version
  7.7.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Analytics Platform for AWS Marketplace Default
n/a
- Version
  7.0.2
  Status
  affected
  Constraints
  <=7.0.2
Vendor Tibco Product Spotfire Automation Services 6 Default
n/a
- Version
  6.5.3
  Status
  affected
  Constraints
  <=6.5.3
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.1
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Connectors Default
n/a
- Version
  7.6.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Deployment Kit Default
n/a
- Version
  6.5.3
  Status
  affected
  Constraints
  <=6.5.3
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.1
  Status
  affected
  Constraints
  -
- Version
  7.5.0
  Status
  affected
  Constraints
  -
- Version
  7.6.0
  Status
  affected
  Constraints
  -
- Version
  7.7.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Desktop Default
n/a
- Version
  6.5.2
  Status
  affected
  Constraints
  <=6.5.2
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.1
  Status
  affected
  Constraints
  -
- Version
  7.5.0
  Status
  affected
  Constraints
  -
- Version
  7.6.0
  Status
  affected
  Constraints
  -
- Version
  7.7.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Desktop Developer Edition Default
n/a
- Version
  7.7.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Desktop Language Packs Default
n/a
- Version
  7.0.1
  Status
  affected
  Constraints
  <=7.0.1
- Version
  7.5.0
  Status
  affected
  Constraints
  -
- Version
  7.6.0
  Status
  affected
  Constraints
  -
- Version
  7.7.0
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Professional Default
n/a
- Version
  6.5.3
  Status
  affected
  Constraints
  <=6.5.3
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.1
  Status
  affected
  Constraints
  -
Vendor Tibco Product Spotfire Web Player Default
n/a
- Version
  6.5.3
  Status
  affected
  Constraints
  <=6.5.3
- Version
  7.0.0
  Status
  affected
  Constraints
  -
- Version
  7.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Tibco

Silver Fabric Enabler for Spotfire Web Player

n/a

Version	Status	Constraints
2.1.2	affected	<=2.1.2

Tibco

Spotfire Analyst

n/a

Version	Status	Constraints
7.5.0	affected	-
7.6.0	affected	-
7.7.0	affected	-

Tibco

Spotfire Analytics Platform for AWS Marketplace

n/a

Version	Status	Constraints
7.0.2	affected	<=7.0.2

Tibco

Spotfire Automation Services 6

n/a

Version	Status	Constraints
6.5.3	affected	<=6.5.3
7.0.0	affected	-
7.0.1	affected	-

Tibco

Spotfire Connectors

n/a

Version	Status	Constraints
7.6.0	affected	-

Tibco

Spotfire Deployment Kit

n/a

Version	Status	Constraints
6.5.3	affected	<=6.5.3
7.0.0	affected	-
7.0.1	affected	-
7.5.0	affected	-
7.6.0	affected	-
7.7.0	affected	-

Tibco

Spotfire Desktop

n/a

Version	Status	Constraints
6.5.2	affected	<=6.5.2
7.0.0	affected	-
7.0.1	affected	-
7.5.0	affected	-
7.6.0	affected	-
7.7.0	affected	-

Tibco

Spotfire Desktop Developer Edition

n/a

Version	Status	Constraints
7.7.0	affected	-

Tibco

Spotfire Desktop Language Packs

n/a

Version	Status	Constraints
7.0.1	affected	<=7.0.1
7.5.0	affected	-
7.6.0	affected	-
7.7.0	affected	-

Tibco

Spotfire Professional

n/a

Version	Status	Constraints
6.5.3	affected	<=6.5.3
7.0.0	affected	-
7.0.1	affected	-

Tibco

Spotfire Web Player

n/a

Version	Status	Constraints
6.5.3	affected	<=6.5.3
7.0.0	affected	-
7.0.1	affected	-

Remediation

No remediation recorded yet.

Metrics

0.61% 0.00608

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00608

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.61% (0.00608)	47.17th	v5 (v2026.06.15)
Sep 20, 2026	0.61% (0.00608)	47.75th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00053)	22.09th	v3 (v2023.03.01)
Jul 10, 2024	0.05% (0.00053)	21.94th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00054)	19.90th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.66% (0.00663)	18.75th	v5 (v2026.06.15)
Apr 14, 2021	0.66% (0.00663)	0.00th	v1

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-79

Cross-site Scripting (XSS)

References (2)

https://www.securityfocus.com/bid/95699
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://www.tibco.com//support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3180
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://www.securityfocus.com/bid/95699		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://www.tibco.com//support/advisories/2017/01/tibco-security-advisory-january-10-2017-tibco-spotfire-2017-3180		x_refsource_CONFIRMVendor Advisory