Critical severity · published Apr 9, 2025
CVE-2025-3115
Spotfire Data Function Vulnerability
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions.
Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DK
Deployment Kit used in Spotfire Server · Spotfire
14.0 before 14.0.7; 14.1.0; 14.2.0; 14.3.0; 14.4.0; 14.4.1 · source: vendor
SA
Spotfire Analyst · Spotfire
14.0 before 14.0.6; 14.1.0; 14.2.0; 14.3.0; 14.4.0; 14.4.1 · source: vendor, NVD
SD
Spotfire Desktop · Spotfire
14.4 before 14.4.2 · source: vendor, NVD
SE
Spotfire Enterprise Runtime for R - Server Edition · Spotfire
1.17 before 1.17.7; 1.18.0; 1.19.0; 1.20.0; 1.21.0; 1.21.1 · source: vendor
SS
Spotfire Service for Python · Spotfire
1.17 before 1.17.7; 1.18.0 through 1.21.1 · source: vendor
SS
Spotfire Service for R · Spotfire
1.17 before 1.17.7; 1.18.0 through 1.21.1 · source: vendor
SS
Spotfire Statistics Services · Spotfire
14 before 14.0.7; 14.1.0; 14.2.0; 14.3.0; 14.4.0; 14.4.1 · source: vendor, NVD
SA
Spotfire Analytics Platform · Tibco
before 14.4.2 · source: NVD
SD
Spotfire Deployment Kit · Tibco
before 14.0.7; 14.1.0; 14.2.0; 14.3.0; 14.4.0; 14.4.1 · source: NVD
SE
Spotfire Enterprise Runtime For R · Tibco
before 6.1.5; before 1.17.7; 1.18.0; 1.19.0; 1.20.0; 1.21.0; +1 more · source: NVD
Affected product
DK
Deployment Kit used in Spotfire Server
Spotfire
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3115
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3115
community.spotfire.com
https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3115-r3485/
More from Deployment Kit used in Spotfire Server
9.4
CVE-2025-3114
Spotfire Code Execution Vulnerability