Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Spotfire Statistics Services ausnutzen, um beliebigen Programmcode auszuführen und Sicherheitsmaßnahmen zu umgehen.
Product
Spotfire Statistics Services ist ein "light-weight" Server, der eine Kommunikationsschicht und eine Serviceschicht, sowie einen S-PLUS oder R "engine pool" und andere Features bietet.
Vulnerabilities 2
-
Critical 9.4
Spotfire Code Execution Vulnerability
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mech…
-
Critical 9.4
Spotfire Data Function Vulnerability
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious …
Revision history
-
#1
Initiale Fassung
References
-
Spotfire Security Advisory CVE-2025-3114 vom 2025-04-08
https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/
-
Spotfire Security Advisory Spotfire - CVE-2025-3115 vom 2025-04-08
https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/