CVE-2020-9416: TIBCO Spotfire Stored Cross Site Scripting Vulnerability

Security readout for executives and security teams

CVE-2020-9416 is a stored cross-site scripting issue in TIBCO Spotfire. A legitimate user could place script content that later runs when another authenticated user views it, using that victim's Spotfire privileges. This matters most where Spotfire holds sensitive analytics or is shared across teams. Exposure is likely limited to organizations running the listed 10.7.x through 10.10.x Spotfire products, especially shared deployments where authenticated users can create or modify content consumed by others. Treat as high priority for affected Spotfire environments handling sensitive analytics. It is not shown as actively exploited, but the potential victim-privilege execution creates meaningful data exposure risk. Mitigation focus: Identify affected Spotfire products and versions in the environment.; Review the TIBCO advisory for vendor-supported fixed releases or mitigations.; Prioritize upgrade or remediation for shared, internet-accessible, or high-data-value deployments..

Prepared

May 23, 2026, 09:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.