CVE-2024-3330

The vulnerability (CWE-250 — execution with excessive privileges) can be exploited in three ways: in the case of an installed Windows client, interaction from a user other than the attacker is required; in the case of Web Player (Business Author), the exploit is possible through it and results in code execution on the Web Player process account; in the case of Automation Services, the exploit occurs directly through this mechanism. The network vector, low level of required interaction, and changed scope (Scope: Changed) indicate the possibility of breaking out of the application context.

Successful exploitation of the vulnerability allows an attacker to execute arbitrary code on the victim's system, which in practice may lead to complete takeover of the host, data theft, or further lateral movement in the network.

Products should be updated to versions outside the vulnerable scope: Spotfire Analyst to a version higher than 14.0.2 (outside the mentioned ranges), Spotfire Server to a version higher than 14.3.0, Spotfire for AWS Marketplace to version 14.3.0 or later. Detailed instructions are available in the official manufacturer's security bulletin: https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-june-262024-spotfire-cve-2024-3330-r3435/

Spotfire Analyst: versions from 12.0.9 to 12.5.0 and from 14.0 to 14.0.2; Spotfire Server: versions from 12.0.10 to 12.5.0, from 14.0 to 14.0.3, and from 14.2.0 to 14.3.0; Spotfire for AWS Marketplace: versions from 14.0 before 14.3.0.