PT-2020-20641 · Tibco Software · Tibco Jasperreports Server For Aws Marketplace+2

Alexander Kornbrust · Published 2020-05-20 · Updated 2024-03-06 · CVE-2020-9409

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 7.1.1 and below TIBCO JasperReports Server for AWS Marketplace versions 7.1.1 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below

Description The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating.

Recommendations For TIBCO JasperReports Server versions 7.1.1 and below, update to a version above 7.1.1 to resolve the issue. For TIBCO JasperReports Server for AWS Marketplace versions 7.1.1 and below, update to a version above 7.1.1 to resolve the issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below, update to a version above 7.1.1 to resolve the issue.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BIT-JASPERREPORTS-2020-9409

CVE-2020-9409

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Activematrix Bpm

References · 7

• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://osv.dev/vulnerability/BIT-jasperreports-2020-9409 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9409 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9409 · Security Note
• https://t.me/cvenotify/3934 · Telegram Post
• https://t.me/avleonovcom/781 · Telegram Post