by Kastro
Paper/Archive/CVE-2022-22771

CVE-2022-22771

TIBCO Software Inc. TIBCO JasperReports Library — TIBCO JasperReports Library Directory Traversal Vulnerability

EPSS 2%CVSS 9.9
critical.is priorityof 100
47
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 83.9.839 × 2016.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.

Affected

ProductAffectedFixed inSource
TIBCO JasperReports Library7.9.0–CNA
TIBCO JasperReports Library for ActiveMatrix BPM7.9.0–CNA
TIBCO JasperReports Server7.9.0–CNA
TIBCO JasperReports Server7.9.1–CNA
TIBCO JasperReports Server for AWS Marketplace7.9.0–CNA
TIBCO JasperReports Server for AWS Marketplace7.9.1–CNA
TIBCO JasperReports Server for ActiveMatrix BPM7.9.0–CNA
TIBCO JasperReports Server for ActiveMatrix BPM7.9.1–CNA
TIBCO JasperReports Server for Microsoft Azure7.9.1–CNA

Scores by source

tibco (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

reftibco.com/services/support/advisoriesreftibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771