Vulnerability · Published May 20, 2020 · Assigned by tibco

CVE-2020-9409TIBCO JasperReports Server Fails To Enforce Access Restrictions

Critical 9.8

In plain English

A critical-severity security flaw in TIBCO JasperReports Server from TIBCO Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)3.5%top 10.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.

Affected products (as reported)

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO JasperReports Server	unspecified – through 7.1.1
TIBCO Software Inc.	TIBCO JasperReports Server for AWS Marketplace	unspecified – through 7.1.1
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	unspecified – through 7.1.1

References

http://www.tibco.com/services/support/advisories x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2020.html x_refsource_MISC