CVE-2013-2372: Cross-site scripting (XSS) vulnerability in the Engine in TIBCO Spotfire Web Player 3.3.x before 3.3.3, 4.0...

Security readout for executives and security teams

CVE-2013-2372 is a cross-site scripting issue in TIBCO Spotfire Web Player. A remote attacker could inject script or HTML through unspecified vectors, potentially affecting users who view manipulated content in the Web Player. The public bundle does not provide CVSS scoring or detailed attack conditions. Exposure is most likely where legacy TIBCO Spotfire Web Player versions remain deployed, especially versions explicitly listed before the fixed releases. The provided affected-product metadata is incomplete, but the description names vulnerable Spotfire Web Player version branches. Treat this as a legacy web application exposure issue. The immediate priority is finding and upgrading old Spotfire Web Player deployments, not emergency incident response, because the bundle does not show active exploitation or a CVSS score. Mitigation focus: Upgrade affected Spotfire Web Player branches to the fixed versions or later supported releases.; Prioritize systems exposing Spotfire Web Player to untrusted users or broad internal audiences.; Review TIBCO advisory guidance before applying environment-specific compensating controls..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.