Lucene search

[email protected]CVE-2022-41561

HistoryDec 13, 2022 - 7:15 p.m.

CVE-2022-41561

2022-12-1319:15:12

[email protected]

web.nvd.nist.gov

tibco

jasperreports

server

jndi

data sources

rce

vulnerability

cve-2022-41561

nvd

security

tibco software inc.

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.4%

JSON

The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.

Affected configurations

NVD

Node

tibcojasperreports_serverRange≤8.0.2aws_marketplace

tibcojasperreports_serverRange≤8.0.2microsoft_azure

tibcojasperreports_serverRange≤8.0.2--

tibcojasperreports_serverRange≤8.1.0community

tibcojasperreports_serverRange≤8.1.0developer

tibcojasperreports_serverMatch8.1.0aws_marketplace

tibcojasperreports_serverMatch8.1.0microsoft_azure

tibcojasperreports_serverMatch8.1.0--

CPENameOperatorVersion
tibco:jasperreports_servertibco jasperreports serverle8.0.2
tibco:jasperreports_servertibco jasperreports serverle8.1.0

CPE	Name	Operator	Version
tibco:jasperreports_server	tibco jasperreports server	le	8.0.2
tibco:jasperreports_server	tibco jasperreports server	le	8.1.0

CNA Affected

[
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server - Community Edition",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.1.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server - Developer Edition",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.1.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for AWS Marketplace",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for AWS Marketplace",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for Microsoft Azure",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for Microsoft Azure",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  }
]