{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-3331",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-3331",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2024-06-27T18:50:13.758Z",
    "updatedAt": "2026-03-02T18:28:16.374Z",
    "importedAt": "2026-10-24T01:57:16.009Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Spotfire: NTLM token leakage",
      "summary": "Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spotfire Spotfire Analyst, Spotfire Spotfire Desktop, Spotfire Spotfire Server allows The impact of this vulnerability depends on the privileges of the user running the affected software..This issue affects Spotfire Enterprise Runtime for R - Server Edition: from 1.12.7 through 1.20.0; Spotfire Statistics Services: from 12.0.7 through 12.3.1, from 14.0.0 through 14.3.0; Spotfire Analyst: from 12.0.9 through 12.5.0, from 14.0.0 through 14.3.0; Spotfire Desktop: from 14.0 through 14.3.0; Spotfire Server: from 12.0.10 through 12.5.0, from 14.0.0 through 14.3.0.",
      "affected": [
        {
          "vendor": "Spotfire",
          "product": "Spotfire Enterprise Runtime for R - Server Edition",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "1.12.7",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "1.20.0"
            }
          ]
        },
        {
          "vendor": "Spotfire",
          "product": "Spotfire Statistics Services",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "12.0.7",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "12.3.1"
            },
            {
              "version": "14.0.0",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "14.3.0"
            }
          ]
        },
        {
          "vendor": "Spotfire",
          "product": "Spotfire Analyst",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "12.0.9",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "12.5.0"
            },
            {
              "version": "14.0.0",
              "status": "affected",
              "versionType": "Patch",
              "lessThanOrEqual": "14.3.0"
            }
          ]
        },
        {
          "vendor": "Spotfire",
          "product": "Spotfire Desktop",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "14.0",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "14.3.0"
            }
          ]
        },
        {
          "vendor": "Spotfire",
          "product": "Spotfire Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "12.0.10",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "12.5.0"
            },
            {
              "version": "14.0.0",
              "status": "affected",
              "versionType": "patch",
              "lessThanOrEqual": "14.3.0"
            }
          ]
        }
      ]
    }
  }
}