CVE-2022-22771

{"containers": {"cna": {"affected": [{"product": "TIBCO JasperReports Library", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}]}, {"product": "TIBCO JasperReports Library for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}]}, {"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for AWS Marketplace", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for Microsoft Azure", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.1"}]}], "datePublic": "2022-03-15T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-15T18:06:14.000Z", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Library version 7.9.0 update to version 7.9.2 or later\nTIBCO JasperReports Library for ActiveMatrix BPM version 7.9.0 update to version 7.9.2 or later\nTIBCO JasperReports Server versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.9.1 update to version 7.9.2 or later"}], "source": {"discovery": "USER"}, "title": "TIBCO JasperReports Library Directory Traversal Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2022-03-15T17:00:00Z", "ID": "CVE-2022-22771", "STATE": "PUBLIC", "TITLE": "TIBCO JasperReports Library Directory Traversal Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO JasperReports Library", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Library for ActiveMatrix BPM", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}, {"version_affected": "=", "version_value": "7.9.1"}]}}, {"product_name": "TIBCO JasperReports Server for AWS Marketplace", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}, {"version_affected": "=", "version_value": "7.9.1"}]}}, {"product_name": "TIBCO JasperReports Server for ActiveMatrix BPM", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}, {"version_affected": "=", "version_value": "7.9.1"}]}}, {"product_name": "TIBCO JasperReports Server for Microsoft Azure", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.1"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems."}]}]}, "references": {"reference_data": [{"name": "https://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "https://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Library version 7.9.0 update to version 7.9.2 or later\nTIBCO JasperReports Library for ActiveMatrix BPM version 7.9.0 update to version 7.9.2 or later\nTIBCO JasperReports Server versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and 7.9.1 update to version 7.9.2 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.9.1 update to version 7.9.2 or later"}], "source": {"discovery": "USER"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:21:49.119Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2022-22771", "datePublished": "2022-03-15T17:05:11.270Z", "dateReserved": "2022-01-07T00:00:00.000Z", "dateUpdated": "2024-09-17T02:57:15.084Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "TIBCO JasperReports Library", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}]}, {"product": "TIBCO JasperReports Library for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}]}, {"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for AWS Marketplace", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}, {"status": "affected", "version": "7.9.1"}]}, {"product": "TIBCO JasperReports Server for Microsoft Azure", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.1"}]}], "source": "security@tibco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:*", "matchCriteriaId": "070D8E68-70C7-473B-BFD4-7AC9BB2B3DB8", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:*", "matchCriteriaId": "91F0A0AF-D4AA-4748-8417-94D4BFA554BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:*", "matchCriteriaId": "C68AA2D6-C235-48FF-9266-FEFCFDAABC44", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:*", "matchCriteriaId": "A91FF4F3-C80F-4EFE-A88E-E3D02C068A7D", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:*", "matchCriteriaId": "2A68573E-34FA-494A-830E-95C4FC94B8E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:*", "matchCriteriaId": "D78581FD-D589-4E9D-BA0A-C40FACF292DA", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:*", "matchCriteriaId": "461CA1B5-776A-4A0B-9740-1A53D57B8ACA", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:*", "matchCriteriaId": "CE3CE50B-2372-4816-886C-DFD102BF9E6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:*", "matchCriteriaId": "10ABB097-92B6-4B11-ABE8-AA29B85B2680", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:*", "matchCriteriaId": "072276FC-1901-4DCC-B7CB-4550137E6F97", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1."}, {"lang": "es", "value": "El componente Server de TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, y TIBCO JasperReports Server for Microsoft Azure contiene una vulnerabilidad de salto de directorio que te\u00f3ricamente puede permitir a usuarios del servidor web acceder al contenido del sistema anfitri\u00f3n. Las versiones afectadas son TIBCO JasperReports Library de TIBCO Software Inc.: versi\u00f3n 7.9.0, TIBCO JasperReports Library para ActiveMatrix BPM: versi\u00f3n 7.9.0, TIBCO JasperReports Server: versiones 7.9.0 y 7.9. 1, TIBCO JasperReports Server para AWS Marketplace: versiones 7.9.0 y 7.9.1, TIBCO JasperReports Server para ActiveMatrix BPM: versiones 7.9.0 y 7.9.1, y TIBCO JasperReports Server para Microsoft Azure: versi\u00f3n 7.9.1"}], "id": "CVE-2022-22771", "lastModified": "2026-06-17T04:29:00.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security@tibco.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-15T17:15:09.137", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}