CVE-2025-3114

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3114", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "state": "PUBLISHED", "assignerShortName": "tibco", "dateReserved": "2025-04-02T10:55:41.023Z", "datePublished": "2025-04-09T17:29:48.612Z", "dateUpdated": "2025-04-15T20:29:11.223Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Spotfire Enterprise Runtime for R", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "1.4", "status": "affected", "version": "6", "versionType": "Patch"}]}, {"defaultStatus": "unaffected", "product": "Spotfire Statistics Services", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.6", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0"}, {"status": "affected", "version": "14.2.0"}, {"status": "affected", "version": "14.3.0"}, {"status": "affected", "version": "14.4.0"}, {"status": "affected", "version": "14.4.1"}]}, {"defaultStatus": "unknown", "product": "Spotfire Analyst", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.5", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Deployment Kit used in Spotfire Server", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.6", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}]}, {"defaultStatus": "unaffected", "product": "Spotfire Desktop", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "4.1", "status": "affected", "version": "14", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Spotfire for AWS Marketplace", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "4.1", "status": "unknown", "version": "14", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Spotfire Enterprise Runtime for R - Server Edition", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "17.6", "status": "affected", "version": "1", "versionType": "Patch"}, {"status": "affected", "version": "1.18.0", "versionType": "Patch"}, {"status": "affected", "version": "1.19.0", "versionType": "Patch"}, {"status": "affected", "version": "1.20.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.1", "versionType": "Patch"}]}], "datePublic": "2025-04-08T16:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><strong>Code Execution via Malicious Files:</strong>&nbsp;Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.</p><p><strong>Sandbox Bypass Vulnerability:</strong>&nbsp;A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.</p>"}], "value": "Code Execution via Malicious Files:\u00a0Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability:\u00a0A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2025-04-09T17:29:48.612Z"}, "references": [{"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"}], "source": {"discovery": "UNKNOWN"}, "title": "Spotfire Code Execution Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T18:03:07.615805Z", "id": "CVE-2025-3114", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T20:29:11.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3114", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-09T18:03:07.615805Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T18:14:43.893Z"}}], "cna": {"title": "Spotfire Code Execution Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spotfire", "product": "Spotfire Enterprise Runtime for R", "versions": [{"status": "affected", "version": "6", "versionType": "Patch", "lessThanOrEqual": "1.4"}], "defaultStatus": "unaffected"}, {"vendor": "Spotfire", "product": "Spotfire Statistics Services", "versions": [{"status": "affected", "version": "14", "versionType": "Patch", "lessThanOrEqual": "0.6"}, {"status": "affected", "version": "14.1.0"}, {"status": "affected", "version": "14.2.0"}, {"status": "affected", "version": "14.3.0"}, {"status": "affected", "version": "14.4.0"}, {"status": "affected", "version": "14.4.1"}], "defaultStatus": "unaffected"}, {"vendor": "Spotfire", "product": "Spotfire Analyst", "versions": [{"status": "affected", "version": "14", "versionType": "Patch", "lessThanOrEqual": "0.5"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}], "defaultStatus": "unknown"}, {"vendor": "Spotfire", "product": "Deployment Kit used in Spotfire Server", "versions": [{"status": "affected", "version": "14", "versionType": "Patch", "lessThanOrEqual": "0.6"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}], "defaultStatus": "unknown"}, {"vendor": "Spotfire", "product": "Spotfire Desktop", "versions": [{"status": "affected", "version": "14", "versionType": "Patch", "lessThanOrEqual": "4.1"}], "defaultStatus": "unaffected"}, {"vendor": "Spotfire", "product": "Spotfire for AWS Marketplace", "versions": [{"status": "unknown", "version": "14", "versionType": "Patch", "lessThanOrEqual": "4.1"}], "defaultStatus": "unknown"}, {"vendor": "Spotfire", "product": "Spotfire Enterprise Runtime for R - Server Edition", "versions": [{"status": "affected", "version": "1", "versionType": "Patch", "lessThanOrEqual": "17.6"}, {"status": "affected", "version": "1.18.0", "versionType": "Patch"}, {"status": "affected", "version": "1.19.0", "versionType": "Patch"}, {"status": "affected", "version": "1.20.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.1", "versionType": "Patch"}], "defaultStatus": "unknown"}], "datePublic": "2025-04-08T16:30:00.000Z", "references": [{"url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Code Execution via Malicious Files:\u00a0Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability:\u00a0A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.", "supportingMedia": [{"type": "text/html", "value": "<p><strong>Code Execution via Malicious Files:</strong>&nbsp;Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.</p><p><strong>Sandbox Bypass Vulnerability:</strong>&nbsp;A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.</p>", "base64": false}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2025-04-09T17:29:48.612Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3114", "state": "PUBLISHED", "dateUpdated": "2025-04-15T20:29:11.223Z", "dateReserved": "2025-04-02T10:55:41.023Z", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "datePublished": "2025-04-09T17:29:48.612Z", "assignerShortName": "tibco"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spotfire Enterprise Runtime for R", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "1.4", "status": "affected", "version": "6", "versionType": "Patch"}]}, {"defaultStatus": "unaffected", "product": "Spotfire Statistics Services", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.6", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0"}, {"status": "affected", "version": "14.2.0"}, {"status": "affected", "version": "14.3.0"}, {"status": "affected", "version": "14.4.0"}, {"status": "affected", "version": "14.4.1"}]}, {"defaultStatus": "unknown", "product": "Spotfire Analyst", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.5", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Deployment Kit used in Spotfire Server", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "0.6", "status": "affected", "version": "14", "versionType": "Patch"}, {"status": "affected", "version": "14.1.0", "versionType": "Patch"}, {"status": "affected", "version": "14.2.0", "versionType": "Patch"}, {"status": "affected", "version": "14.3.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.0", "versionType": "Patch"}, {"status": "affected", "version": "14.4.1", "versionType": "Patch"}]}, {"defaultStatus": "unaffected", "product": "Spotfire Desktop", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "4.1", "status": "affected", "version": "14", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Spotfire for AWS Marketplace", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "4.1", "status": "unknown", "version": "14", "versionType": "Patch"}]}, {"defaultStatus": "unknown", "product": "Spotfire Enterprise Runtime for R - Server Edition", "vendor": "Spotfire", "versions": [{"lessThanOrEqual": "17.6", "status": "affected", "version": "1", "versionType": "Patch"}, {"status": "affected", "version": "1.18.0", "versionType": "Patch"}, {"status": "affected", "version": "1.19.0", "versionType": "Patch"}, {"status": "affected", "version": "1.20.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.0", "versionType": "Patch"}, {"status": "affected", "version": "1.21.1", "versionType": "Patch"}]}], "source": "security@tibco.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Code Execution via Malicious Files:\u00a0Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise.\n\nSandbox Bypass Vulnerability:\u00a0A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls."}, {"lang": "es", "value": "Ejecuci\u00f3n de c\u00f3digo mediante archivos maliciosos: Los atacantes pueden crear archivos especialmente manipulados con c\u00f3digo incrustado que puede ejecutarse sin la validaci\u00f3n de seguridad adecuada, lo que podr\u00eda comprometer el sistema. Vulnerabilidad de elusi\u00f3n de la zona de pruebas: Una falla en el mecanismo de seguridad TERR permite a los atacantes eludir las restricciones de la zona de pruebas, lo que permite la ejecuci\u00f3n de c\u00f3digo no confiable sin los controles adecuados."}], "id": "CVE-2025-3114", "lastModified": "2026-06-17T09:19:12.500", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@tibco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3114", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-09T18:03:07.615805Z", "version": "2.0.3"}}]}, "published": "2025-04-09T18:15:50.643", "references": [{"source": "security@tibco.com", "url": "https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-693"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}