PT-2020-4877 · Tibco Software · Fusioncharts+5

Published 2020-05-19 · Updated 2024-03-06 · CVE-2020-9410

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TIBCO JasperReports Library versions 7.1.1 and below, 7.2.0, 7.2.1, 7.3.0, 7.5.0 TIBCO JasperReports Library for ActiveMatrix BPM versions 7.1.1 and below TIBCO JasperReports Server versions 7.1.1 and below, 7.2.0, 7.5.0 TIBCO JasperReports Server for AWS Marketplace versions 7.5.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below

Description: The report generator component of TIBCO Software Inc.'s products contains a vulnerability related to insufficient neutralization of special elements in output, which can be exploited to gain full control of a web interface with the privileges of any user viewing the affected report. This can be achieved through HTML injection when other users view a maliciously generated report that uses Fusion Charts and a data source controlled by the attacker.

Recommendations: For TIBCO JasperReports Library versions 7.1.1 and below, 7.2.0, 7.2.1, 7.3.0, 7.5.0: Update to a version that includes the fix for this issue. For TIBCO JasperReports Library for ActiveMatrix BPM versions 7.1.1 and below: Update to a version that includes the fix for this issue. For TIBCO JasperReports Server versions 7.1.1 and below, 7.2.0, 7.5.0: Update to a version that includes the fix for this issue. For TIBCO JasperReports Server for AWS Marketplace versions 7.5.0 and below: Update to a version that includes the fix for this issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below: Update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to reports that use Fusion Charts and a data source with contents controlled by the attacker until a patch is available.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

BDU:2020-05431

BIT-JASPERREPORTS-2020-9410

CVE-2020-9410

Affected Products

Fusioncharts

Tibco Jasperreports Library

Tibco Jasperreports Library For Activematrix Bpm

Tibco Jasperreports Server

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Activematrix Bpm

References · 7

• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://osv.dev/vulnerability/BIT-jasperreports-2020-9410 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9410 · Security Note
• https://bdu.fstec.ru/vul/2020-05431 · Security Note
• https://t.me/cvenotify/3935 · Telegram Post