Vulnerability Intelligence Report

TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability

CVE-2022-22773

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.

No Active Exploit Signals

CVSS Base Score

7.7

HIGH

Exploitability:1.3

Impact Score:5.8

EPSS Probability:0.48%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

Affected Products & Versions

Vendor	Product	Affected Versions
TIBCO Software Inc.	TIBCO JasperReports Server	unspecified <= 8.0.1 (affected)
TIBCO Software Inc.	TIBCO JasperReports Server - Community Edition	unspecified <= 8.0.1 (affected)
TIBCO Software Inc.	TIBCO JasperReports Server - Developer Edition	unspecified <= 8.0.0 (affected)
TIBCO Software Inc.	TIBCO JasperReports Server for AWS Marketplace	unspecified <= 8.0.1 (affected)
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	unspecified <= 7.9.2 (affected)
TIBCO Software Inc.	TIBCO JasperReports Server for Microsoft Azure	unspecified <= 8.0.1 (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

0.477%

GitHub Advisory

GHSA-mf8h-5f5r-mpg8 ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	TIBCO Software Inc. · Vendor · USA
Reserved	2022-01-07T00:00:00
Published	2022-05-17T17:30:13
Patch Date	2022-05-17
Last Updated	2024-09-16T20:36:15

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2022-22773

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2022-22773

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE