PT-2021-20936 · Tibco Software · Tibco Jasperreports Server For Aws Marketplace+5

Published 2021-10-12 · Updated 2024-03-06 · CVE-2021-35496

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TIBCO JasperReports Server versions 7.2.1 and below TIBCO JasperReports Server versions 7.5.0 and 7.5.1 TIBCO JasperReports Server version 7.8.0 TIBCO JasperReports Server version 7.9.0 TIBCO JasperReports Server - Community Edition versions 7.8.0 and below TIBCO JasperReports Server - Developer Edition versions 7.9.0 and below TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below TIBCO JasperReports Server for Microsoft Azure version 7.8.0

Description: The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. A successful attack using this vulnerability requires human interaction from a person other than the attacker.

Recommendations: For TIBCO JasperReports Server versions 7.2.1 and below, update to a version above 7.2.1. For TIBCO JasperReports Server versions 7.5.0 and 7.5.1, update to a version above 7.5.1. For TIBCO JasperReports Server version 7.8.0, update to a version above 7.8.0. For TIBCO JasperReports Server version 7.9.0, update to a version above 7.9.0. For TIBCO JasperReports Server - Community Edition versions 7.8.0 and below, update to a version above 7.8.0. For TIBCO JasperReports Server - Developer Edition versions 7.9.0 and below, update to a version above 7.9.0. For TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below, update to a version above 7.9.0. For TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below, update to a version above 7.9.0. For TIBCO JasperReports Server for Microsoft Azure version 7.8.0, update to a version above 7.8.0.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BIT-JASPERREPORTS-2021-35496

CVE-2021-35496

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server - Developer Edition

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jasperreports Server For Microsoft Azure

References · 5

• https://tibco.com/services/support/advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35496 · Security Note
• https://osv.dev/vulnerability/BIT-jasperreports-2021-35496 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35496 · Vendor Advisory
• https://t.me/cibsecurity/30451 · Telegram Post