CVE-2018-5436: TIBCO Spotfire Server information disclosure vulnerabilities

Security readout for executives and security teams

CVE-2018-5436 is an information disclosure issue in TIBCO Spotfire Server and the AWS Marketplace Spotfire Analytics Platform. A low-privileged authenticated user may be able to expose sensitive information, including user and data source credentials. This is mainly a confidentiality risk, not a service outage risk. Exposure is most likely in organizations still running affected Spotfire Server versions through 7.12.0 or AWS Marketplace releases through 7.12.0. Risk increases where Spotfire is reachable by broad internal audiences, partners, or the internet. Treat this as a moderate-priority credential exposure risk. Prioritize remediation for internet-facing, partner-facing, or broadly accessible Spotfire environments, especially where Spotfire stores production data source credentials. Mitigation focus: Check TIBCO advisory guidance and upgrade affected Spotfire components to a fixed supported release.; Limit network access to Spotfire Server and administrative interfaces.; Review and rotate stored user or data source credentials if exposure is suspected..

Prepared

May 24, 2026, 20:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.