PT-2022-25941 · Tibco · Tibco Jasperreports Server For Aws Marketplace+4

Published 2022-12-13 · Updated 2024-03-06 · CVE-2022-41562

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 8.0.2 and below TIBCO JasperReports Server version 8.1.0 TIBCO JasperReports Server - Community Edition versions 8.1.0 and below TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below TIBCO JasperReports Server for AWS Marketplace version 8.1.0 TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below TIBCO JasperReports Server for Microsoft Azure version 8.1.0

Description The HTML escaping component of TIBCO JasperReports Server contains a vulnerability that allows a privileged/administrative attacker with network access to execute an XSS attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker.

Recommendations For TIBCO JasperReports Server versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server version 8.1.0, update to a version above 8.1.0. For TIBCO JasperReports Server - Community Edition versions 8.1.0 and below, update to a version above 8.1.0. For TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below, update to a version above 8.1.0. For TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for AWS Marketplace version 8.1.0, update to a version above 8.1.0. For TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for Microsoft Azure version 8.1.0, update to a version above 8.1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JASPERREPORTS-2022-41562

CVE-2022-41562

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server - Developer Edition

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Microsoft Azure

References · 8

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41562 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-41562 · Security Note
• https://ubuntu.com/security/CVE-2022-41562 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41562 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41562 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jasperreports-2022-41562 · Vendor Advisory