### [CVE-2021-23273](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23273)
![](https://img.shields.io/static/v1?label=Product&message=TIBCO%20Spotfire%20Analyst&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TIBCO%20Spotfire%20Analytics%20Platform%20for%20AWS%20Marketplace&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TIBCO%20Spotfire%20Desktop&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=TIBCO%20Spotfire%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=10.10.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.10.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.10.2%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.10.3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.7.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.8.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.8.1%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=10.9.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=11.0.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=11.1.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=The%20impact%20of%20this%20vulnerability%20includes%20the%20theoretical%20possibility%20that%20an%20attacker%20gains%20access%2C%20including%20potentially%20administrative%20access%2C%20to%20the%20affected%20system.&color=brightgreen)

### Description

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below, TIBCO Spotfire Desktop: versions 10.3.3 and below, versions 10.10.0, 10.10.1, and 10.10.2, versions 10.7.0, 10.8.0, 10.9.0, 11.0.0, and 11.1.0, and TIBCO Spotfire Server: versions 10.3.11 and below, versions 10.10.0, 10.10.1, 10.10.2, and 10.10.3, versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 11.0.0, and 11.1.0.

### POC

#### Reference
- http://www.tibco.com/services/support/advisories

#### Github
No PoCs found on GitHub currently.