CVE-2018-12410
CVE-2018-12410 is a critical-severity vulnerability in Tibco Spotfire Statistics Services with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v2: 7.5
- EPSS exploit prediction: 4% (89th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Tibco Spotfire Statistics Services
- Published:
- Last modified:
Description
The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.
Frequently asked questions
- What is CVE-2018-12410?
- The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Affected releases are TIBCO Software Inc. TIBCO Spotfire Statistics Services versions up to and including 7.11.0.
- How severe is CVE-2018-12410?
- CVE-2018-12410 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2018-12410 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (89th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2018-12410?
- CVE-2018-12410 affects Tibco Spotfire Statistics Services. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2018-12410?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2018-12410 published?
- CVE-2018-12410 was published on 2018-10-10 and last updated on 2026-06-17.
References
- http://www.securityfocus.com/bid/105558
- https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics
Affected products (1)
- cpe:2.3:a:tibco:spotfire_statistics_services:*:*:*:*:*:*:*:*
More vulnerabilities in Tibco Spotfire Statistics Services
- CVE-2025-3115 — Critical (CVSS 9.8): Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing…
- CVE-2023-29268 — Critical (CVSS 9.8): The Splus Server component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that…
- CVE-2021-28830 — High (CVSS 8.8): The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise…
- CVE-2021-23275 — High (CVSS 8.8): The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO…
- CVE-2019-11204 — High (CVSS 8.8): The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that…
- CVE-2013-2371 — Medium (CVSS 5.0): The Web API in the Statistics Server in TIBCO Spotfire Statistics Services 3.3.x before 3.3.1, 4.5.x before 4.5.1, and…