Log in Start free

Vulnerability · Published Oct 12, 2021 · Assigned by tibco

CVE-2021-35496TIBCO JasperReports XML Eternal Entity (XXE) vulnerability

High 7.5

In plain English

A high-severity security flaw in TIBCO JasperReports Server from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Affected products (as reported)

VendorProductVersions
TIBCO Software Inc. TIBCO JasperReports Server unspecified – through 7.2.1
TIBCO Software Inc. TIBCO JasperReports Server 7.5.07.5.1
TIBCO Software Inc. TIBCO JasperReports Server 7.8.0
TIBCO Software Inc. TIBCO JasperReports Server 7.9.0
TIBCO Software Inc. TIBCO JasperReports Server - Community Edition unspecified – through 7.8.0
TIBCO Software Inc. TIBCO JasperReports Server - Developer Edition unspecified – through 7.9.0
TIBCO Software Inc. TIBCO JasperReports Server for AWS Marketplace unspecified – through 7.9.0
TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM unspecified – through 7.9.0
TIBCO Software Inc. TIBCO JasperReports Server for Microsoft Azure 7.8.0

References