CVE-2018-18813 : Security Advisory and Response

TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server have been identified with multiple vulnerabilities that could lead to persistent and reflected cross-site scripting attacks.

Understanding CVE-2018-18813

This CVE involves security issues in TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server, potentially allowing attackers to execute cross-site scripting attacks.

What is CVE-2018-18813?

CVE-2018-18813 refers to the presence of reflected and persistent cross-site scripting vulnerabilities in TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server.

The Impact of CVE-2018-18813

The vulnerabilities in TIBCO Spotfire Analytics Platform and TIBCO Spotfire Server could enable unauthenticated attackers to perform administrative functions through the web interface of the affected components.

Technical Details of CVE-2018-18813

This section provides detailed technical information about the CVE-2018-18813 vulnerability.

Vulnerability Description

The vulnerabilities in TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server allow for persistent and reflected cross-site scripting attacks.

Affected Systems and Versions

TIBCO Spotfire Analytics Platform for AWS Marketplace up to and including version 10.0.0
TIBCO Spotfire Server versions 7.10.1, 7.11.0, 7.11.1, 7.12.0, 7.13.0, 7.14.0, and 10.0.0

Exploitation Mechanism

The vulnerabilities can be exploited through network-based attacks with low complexity, requiring user interaction but no privileges.

Mitigation and Prevention

To address CVE-2018-18813, follow the mitigation and prevention steps outlined below.

Immediate Steps to Take

Update TIBCO Spotfire Analytics Platform for AWS Marketplace to version 10.0.1 or higher
Update TIBCO Spotfire Server versions 7.10.1 and below to version 7.10.2 or higher
Update TIBCO Spotfire Server versions 7.11.0 and 7.11.1 to version 7.11.2 or higher
Update TIBCO Spotfire Server versions 7.12.0, 7.13.0, 7.14.0, and 10.0.0 to version 10.0.1 or higher

Long-Term Security Practices

Regularly monitor and update software versions to patch known vulnerabilities
Implement secure coding practices to prevent cross-site scripting attacks

Patching and Updates

Ensure all affected systems are updated to the latest software versions provided by TIBCO to mitigate the CVE-2018-18813 vulnerabilities.