{
  "id": "CVE-2022-22771",
  "sourceIdentifier": "security@tibco.com",
  "published": "2022-03-15T17:15:09.137",
  "lastModified": "2024-11-21T06:47:24.937",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1."
    },
    {
      "lang": "es",
      "value": "El componente Server de TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, y TIBCO JasperReports Server for Microsoft Azure contiene una vulnerabilidad de salto de directorio que te\u00f3ricamente puede permitir a usuarios del servidor web acceder al contenido del sistema anfitri\u00f3n. Las versiones afectadas son TIBCO JasperReports Library de TIBCO Software Inc.: versi\u00f3n 7.9.0, TIBCO JasperReports Library para ActiveMatrix BPM: versi\u00f3n 7.9.0, TIBCO JasperReports Server: versiones 7.9.0 y 7.9. 1, TIBCO JasperReports Server para AWS Marketplace: versiones 7.9.0 y 7.9.1, TIBCO JasperReports Server para ActiveMatrix BPM: versiones 7.9.0 y 7.9.1, y TIBCO JasperReports Server para Microsoft Azure: versi\u00f3n 7.9.1"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV30": [
      {
        "source": "security@tibco.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "baseScore": 4.0,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:*",
              "matchCriteriaId": "070D8E68-70C7-473B-BFD4-7AC9BB2B3DB8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "91F0A0AF-D4AA-4748-8417-94D4BFA554BD"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:*",
              "matchCriteriaId": "C68AA2D6-C235-48FF-9266-FEFCFDAABC44"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "A91FF4F3-C80F-4EFE-A88E-E3D02C068A7D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:*",
              "matchCriteriaId": "2A68573E-34FA-494A-830E-95C4FC94B8E9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:*",
              "matchCriteriaId": "D78581FD-D589-4E9D-BA0A-C40FACF292DA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:*",
              "matchCriteriaId": "461CA1B5-776A-4A0B-9740-1A53D57B8ACA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "CE3CE50B-2372-4816-886C-DFD102BF9E6F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:*",
              "matchCriteriaId": "10ABB097-92B6-4B11-ABE8-AA29B85B2680"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:*",
              "matchCriteriaId": "072276FC-1901-4DCC-B7CB-4550137E6F97"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tibco.com/services/support/advisories",
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771",
      "source": "security@tibco.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.tibco.com/services/support/advisories",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}