CVE-2019-11210
Last modified
CVE-2019-11210 is a critical-severity vulnerability rated 10/10 on the CVSS scale. The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and remotely execute code using the operating system account hosting the affected component. This issue affects: TIBCO Enterprise Runtime for R - Server Edition versions 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.4.0 and 10.5.0.. EPSS estimates a 3.66% chance of exploitation in the next 30 days.
Description
The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and remotely execute code using the operating system account hosting the affected component. This issue affects: TIBCO Enterprise Runtime for R - Server Edition versions 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.4.0 and 10.5.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tibco | Enterprise Runtime For R | <= 1.2.0 |
| Tibco | Spotfire Analytics Platform For Aws | 10.4.0 |
| Tibco | Spotfire Analytics Platform For Aws | 10.5.0 |
References
- http://www.tibco.com/services/support/advisoriesVendor Advisory
- http://www.tibco.com/services/support/advisoriesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-11210?
How severe is CVE-2019-11210?
How do I fix CVE-2019-11210?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-11205The web server component of TIBCO Software Inc.'s TIBCO Spot…8.8
- CVE-2019-11206The Spotfire library component of TIBCO Software Inc.'s TIBC…5.3
- CVE-2019-11207The web server component of TIBCO Software Inc.'s TIBCO LogL…8.8
- CVE-2019-11208The authorization component of TIBCO Software Inc.'s TIBCO A…9.9
- CVE-2019-11209The realm configuration component of TIBCO Software Inc.'s T…8.8
- CVE-2019-1121A remote code execution vulnerability exists in the way that…
- CVE-2019-11211The server component of TIBCO Software Inc.'s TIBCO Enterpri…9.9
- CVE-2019-11212The MDM server component of TIBCO Software Inc's TIBCO MDM c…5.4
- CVE-2019-11213In Pulse Secure Pulse Desktop Client and Network Connect, an…
- CVE-2019-11215In Combodo iTop 2.2.0 through 2.6.0, if the configuration fi…8.1
- CVE-2019-11216BMC Smart Reporting 7.3 20180418 allows authenticated XXE wi…6.5
- CVE-2019-11217The GitController in Jakub Chodounsky Bonobo Git Server befo…
Are you affected by CVE-2019-11210?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST