FlagThis
← Back to CVE List
Vulnerability Intelligence Report
TIBCO JasperReports Server Stored XSS Vulnerability

CVE-2022-41563

The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.

No Active Exploit Signals
CVSS Base Score
9.0
CRITICAL
Exploitability:2.3
Impact Score:6.1
EPSS Probability:0.87%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—

Affected Products & Versions

Vendor Product Affected Versions
TIBCO Software Inc. TIBCO JasperReports Server unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server - Developer Edition unspecified <= 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for AWS Marketplace unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for AWS Marketplace 8.1.0 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for Microsoft Azure unspecified <= 8.0.2 (affected)
TIBCO Software Inc. TIBCO JasperReports Server for Microsoft Azure 8.1.0 (affected)

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗
No reference links found.

Threat Intelligence Signals

EPSS Score
0.873%
GitHub Advisory
GHSA-2wj3-4hph-hjgw ↗

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityTIBCO Software Inc. · Vendor · USA
Reserved2022-09-26T00:00:00
Published2022-12-15T03:44:03
Patch Date2022-12-13
Last Updated2024-09-16T19:36:24

Related Intelligence

Related CVEs
CVE-2022-22771 CVSS 9.9 — The Server component of TIBCO Software Inc.'s TIBCO JasperReports Libr…
CVE-2022-41561 CVSS 9.1 — The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperR…
CVE-2021-35495 CVSS 9.0 — The Scheduler Connection component of TIBCO Software Inc.'s TIBCO Jasp…
CVE-2022-41562 CVSS 8.4 — The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperRepor…
CVE-2022-22773 CVSS 7.7 — The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Se…
LINK COPIED TO CLIPBOARD