Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveTibcoCVE-2022-41562
HistoryDec 15, 2022 - 3:44 a.m.

CVE-2022-41562

2022-12-1503:44:03
CWE-79
tibco
web.nvd.nist.gov
36
tibco software inc
jasperreports server
html escaping
vulnerability
xss
network access
cve-2022-41562

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute an XSS attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.

Affected configurations

Nvd
Node
tibcojasperreports_serverRange≤8.0.2aws_marketplace
OR
tibcojasperreports_serverRange≤8.0.2microsoft_azure
OR
tibcojasperreports_serverRange≤8.0.2--
OR
tibcojasperreports_serverRange≤8.1.0community
OR
tibcojasperreports_serverRange≤8.1.0developer
OR
tibcojasperreports_serverMatch8.1.0aws_marketplace
OR
tibcojasperreports_serverMatch8.1.0microsoft_azure
OR
tibcojasperreports_serverMatch8.1.0--
VendorProductVersionCPE
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:aws_marketplace:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:microsoft_azure:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:-:-:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:developer:*:*:*
tibcojasperreports_server8.1.0cpe:2.3:a:tibco:jasperreports_server:8.1.0:*:*:*:*:aws_marketplace:*:*
tibcojasperreports_server8.1.0cpe:2.3:a:tibco:jasperreports_server:8.1.0:*:*:*:*:microsoft_azure:*:*
tibcojasperreports_server8.1.0cpe:2.3:a:tibco:jasperreports_server:8.1.0:*:*:*:-:-:*:*

CNA Affected

[
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server - Community Edition",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.1.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server - Developer Edition",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.1.0",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for AWS Marketplace",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for AWS Marketplace",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for Microsoft Azure",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "8.0.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TIBCO Software Inc.",
    "product": "TIBCO JasperReports Server for Microsoft Azure",
    "versions": [
      {
        "version": "8.1.0",
        "status": "affected"
      }
    ]
  }
]

Related

ubuntucve 1
osv 1
cvelist 1
nvd 1
prion 1
ubuntucve
ubuntucve
CVE-2022-41562
2022-12-13 00:00:00
osv
osv
BIT-jasperreports-2022-41562
2024-03-06 10:54:13
cvelist
cvelist
CVE-2022-41562 TIBCO JasperReports Server XSS Issue on Roles
2022-12-15 03:44:03
nvd
nvd
CVE-2022-41562
2022-12-13 19:15:12
prion
prion
Design/Logic Flaw
2022-12-13 19:15:00

CVSS3

8.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON
Related for CVE-2022-41562
ubuntucve1osv1cvelist1nvd1prion1