Unscored severity · published Mar 15, 2013
CVE-2013-2373
The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 does not properly implement access control, which allows…
–
CVSS
1.3%
EPSS
No
On KEV
Description
The Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 does not properly implement access control, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SW
Spotfire Web Player · Tibco
3.3; 3.3.2; 4.0; 4.0.1; 4.0.2; 4.5.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2373
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2373
Vendor Advisory
http://www.tibco.com/mk/advisory.jsp
Vendor Advisory
http://www.tibco.com/multimedia/spotfire-web-player-advisory-2013-03-12_tcm8-18480.txt
Vendor Advisory
http://www.tibco.com/services/support/advisories/spotfire-advisory_20130313.jsp
More from Spotfire Web Player
5.4
CVE-2017-3180
Multiple TIBCO Products are prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input
–
CVE-2015-4554
Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x…
–
CVE-2014-7195
Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver…
–
CVE-2013-2372
Cross-site scripting (XSS) vulnerability in the Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0.x before 4.0.3, 4.5.x before 4.5.1, and 5.0.x before 5.0.1 allows…