CVE-2025-3115 json
Spotfire Data Function Vulnerability
published 2025-04-09 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-10552
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Injection Vulnerabilities: Attackers can inject malicious code, potentially gaining control over the system executing these functions. Additionally, insufficient validation of filenames during file uploads can enable attackers to upload and execute malicious files, leading to arbitrary code execution
Patch / fix
- Spotfire Spotfire Statistics Services 14.0.7
- Spotfire Spotfire Analyst 14.0.6
- Spotfire Deployment Kit used in Spotfire Server 14.0.7
- Spotfire Spotfire Desktop 14.4.2
- Spotfire Spotfire Enterprise Runtime for R - Server Edition 1.17.7
- Spotfire Spotfire Service for Python 1.17.7
- Spotfire Spotfire Service for R 1.17.7
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Spotfire Spotfire Statistics Services
- Spotfire Spotfire Analyst
- Spotfire Deployment Kit used in Spotfire Server
- Spotfire Spotfire Desktop
- Spotfire Spotfire for AWS Marketplace
- Spotfire Spotfire Enterprise Runtime for R - Server Edition
- Spotfire Spotfire Service for Python
- Spotfire Spotfire Service for R
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
Sources
- CVE List CVE-2025-3115
- NVD CVE-2025-3115
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.