PT-2022-15662 · Tibco · Tibco Jasperreports Library For Activematrix Bpm+5

Published 2022-03-15 · Updated 2024-03-06 · CVE-2022-22771

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Library version 7.9.0 TIBCO JasperReports Library for ActiveMatrix BPM version 7.9.0 TIBCO JasperReports Server versions 7.9.0 through 7.9.1 TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 through 7.9.1 TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 through 7.9.1 TIBCO JasperReports Server for Microsoft Azure version 7.9.1

Description The Server component of TIBCO Software Inc.'s TIBCO JasperReports products contains a directory-traversal issue that may allow web server users to access contents of the host system.

Recommendations For TIBCO JasperReports Library version 7.9.0, update to a version that contains a fix for this issue. For TIBCO JasperReports Library for ActiveMatrix BPM version 7.9.0, update to a version that contains a fix for this issue. For TIBCO JasperReports Server versions 7.9.0 through 7.9.1, update to a version that contains a fix for this issue. For TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 through 7.9.1, update to a version that contains a fix for this issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 through 7.9.1, update to a version that contains a fix for this issue. For TIBCO JasperReports Server for Microsoft Azure version 7.9.1, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-JASPERREPORTS-2022-22771

CVE-2022-22771

Affected Products

Tibco Jasperreports Library

Tibco Jasperreports Library For Activematrix Bpm

Tibco Jasperreports Server

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jasperreports Server For Microsoft Azure

References · 9

• https://tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22771 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-22771 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jasperreports-2022-22771 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22771 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-22771 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22771 · Security Note
• https://t.me/cibsecurity/38941 · Telegram Post