TIBCO Spotfire Web Application Web Player Application Automation Services Application and Analytics Client Application in Spotfire Analytics Server before 10.1.2; Server before 3.3.3; and Web Player Automation Services and Professional before 4.0.2 allow remote attackers to obtain sensitive information via a crafted URL.