FlagThis
← Back to CVE List
Vulnerability Intelligence Report
TIBCO JasperReports Server RCE Vulnerability

CVE-2022-41561

The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.

No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:1.44%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Affected Products & Versions

Vendor Product Affected Versions
TIBCO Software Inc. TIBCO JasperReports Server unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server - Community Edition unspecified <= 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server - Developer Edition unspecified <= 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for AWS Marketplace unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for AWS Marketplace 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for Microsoft Azure unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for Microsoft Azure 8.1.0 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
1.444%
GitHub Advisory
GHSA-6jvq-qq93-6gh3 ↗

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityTIBCO Software Inc. · Vendor · USA
Reserved2022-09-26T00:00:00
Published2022-12-15T03:44:03
Patch Date2022-12-13
Last Updated2024-09-17T02:05:41

Related Intelligence

Related CVEs
CVE-2021-35495 CVSS 9.0 — The Scheduler Connection component of TIBCO Software Inc.'s TIBCO Jasp…
CVE-2022-41562 CVSS 8.4 — The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperRepor…
CVE-2022-22773 CVSS 7.7 — The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Se…
CVE-2021-35496 CVSS 7.5 — The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperRe…
CVE-2021-35494 CVSS 5.7 — The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Se…
LINK COPIED TO CLIPBOARD