PT-2022-25942 · Tibco · Tibco Jasperreports Server+3

Published 2022-12-13 · Updated 2024-03-06 · CVE-2022-41563

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 8.0.2 and below TIBCO JasperReports Server version 8.1.0 TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below TIBCO JasperReports Server for AWS Marketplace version 8.1.0 TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below TIBCO JasperReports Server for Microsoft Azure version 8.1.0

Description The Dashboard component of TIBCO JasperReports Server contains a vulnerability that allows a low-privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack requires human interaction from a person other than the attacker.

Recommendations For TIBCO JasperReports Server versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server version 8.1.0, consider disabling the Dashboard component until a patch is available. For TIBCO JasperReports Server - Developer Edition versions 8.1.0 and below, update to a version above 8.1.0. For TIBCO JasperReports Server for AWS Marketplace versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for AWS Marketplace version 8.1.0, consider disabling the Dashboard component until a patch is available. For TIBCO JasperReports Server for Microsoft Azure versions 8.0.2 and below, update to a version above 8.0.2. For TIBCO JasperReports Server for Microsoft Azure version 8.1.0, consider disabling the Dashboard component until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-JASPERREPORTS-2022-41563

CVE-2022-41563

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server - Developer Edition

Tibco Jasperreports Server For Aws Marketplace

Tibco Jasperreports Server For Microsoft Azure

References · 8

• https://cve.org/CVERecord?id=CVE-2022-41563 · Security Note
• https://tibco.com/support/advisories/2022/12/tibco-security-advisory-december-13-2022-tibco-jasperreports-server-cve-2022-41563 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-41563 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jasperreports-2022-41563 · Vendor Advisory
• https://tibco.com/services/support/advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41563 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41563 · Security Note
• https://ubuntu.com/security/CVE-2022-41563 · Vendor Advisory