CVE-2022-22771 — HIGH (8.8)

Vulnerability Description

The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Tibco	Jasperreports Library	7.9.0
Tibco	Jasperreports Server	7.9.0

Related Weaknesses (CWE)

CWE-22

References

https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-1Vendor Advisory
https://www.tibco.com/services/support/advisoriesVendor Advisory
https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-1Vendor Advisory

FAQ

What is CVE-2022-22771?

CVE-2022-22771 is a vulnerability with a CVSS score of 8.8 (HIGH). The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace,...

How severe is CVE-2022-22771?

CVE-2022-22771 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-22771?

Check the references section above for vendor advisories and patch information. Affected products include: Tibco Jasperreports Library, Tibco Jasperreports Server.