PT-2022-25940 · Tibco Software · Tibco Jasperreports Server For Microsoft Azure+4

Published 2022-12-13 · Updated 2024-03-06 · CVE-2022-41561

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 8.0.2 and below TIBCO JasperReports Server version 8.1.0 TIBCO JasperReports Server - Community Edition versions 8.1.0 and below TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below TIBCO JasperReports Server for AWS Marketplace version 8.1.0 TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below TIBCO JasperReports Server for Microsoft Azure version 8.1.0

Description The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server contains a vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system.

Recommendations For TIBCO JasperReports Server versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server version 8.1.0, apply the necessary security patches. For TIBCO JasperReports Server - Community Edition versions 8.1.0 and below, update to a version above 8.1.0. For TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below, update to a version above 8.1.0. For TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for AWS Marketplace version 8.1.0, apply the necessary security patches. For TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for Microsoft Azure version 8.1.0, apply the necessary security patches.

Fix

Related Identifiers

BIT-JASPERREPORTS-2022-41561

CVE-2022-41561

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server - Developer Edition

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Microsoft Azure

References · 8

• https://osv.dev/vulnerability/BIT-jasperreports-2022-41561 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41561 · Security Note
• https://tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41561 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41561 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41561 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41561 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41561 · Vendor Advisory