CVE Vulnerability

CVE-2022-22771

The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.

4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.tibco.com/services/support/advisories Vendor Advisory
https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:*
cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:*
cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:*
cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:*
Information

Published : 2022-03-15 05:15

Updated : 2022-03-22 05:44

NVD link : CVE-2022-22771

Mitre link : CVE-2022-22771

Products Affected
No products.
CWE
CWE-22