CVE-2022-41561critical

CVE-2022-41561: critical vulnerability in TIBCO JasperReports Server

TIBCO JasperReports Server RCE Vulnerability

Published · Updated

Follow this CVE+ Monitor TIBCO JasperReports Server+ Monitor TIBCO JasperReports Server for AWS Marketplace

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.6%
The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for Microsoft Azure, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows a privileged/administrative attacker with network access to execute Remote Code Execution to obtain a reverse shell on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.2 and below, TIBCO JasperReports Server: version 8.1.0, TIBCO JasperReports Server - Community Edition: versions 8.1.0 and below, TIBCO JasperReports Server - Developer Edition: versions 8.1.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.2 and below, TIBCO JasperReports Server for AWS Marketplace: version 8.1.0, TIBCO JasperReports Server for Microsoft Azure: versions 8.0.2 and below, and TIBCO JasperReports Server for Microsoft Azure: version 8.1.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
TIBCO Software Inc. · TIBCO JasperReports ServerTIBCO Software Inc. · TIBCO JasperReports Server - Community EditionTIBCO Software Inc. · TIBCO JasperReports Server - Developer EditionTIBCO Software Inc. · TIBCO JasperReports Server for AWS MarketplaceTIBCO Software Inc. · TIBCO JasperReports Server for Microsoft Azure
Related CVEs — TIBCO JasperReports Server

In the same product, most dangerous first.

CVE-2018-18809CRITICALTIBCO JasperReports Library Directory Traversal VulnerabilityEPSS 79.1%KEVCVE-2018-5430HIGHTIBCO JasperReports Server Information Disclosure VulnerabilityEPSS 48.1%KEVCVE-2020-9410HIGHTIBCO JasperReports LibraryEPSS 5.4%CVE-2020-9409CRITICALTIBCO JasperReports Server Fails To Enforce Access RestrictionsEPSS 3.5%CVE-2018-18815CRITICALTIBCO JasperReports Server User Information DisclosureEPSS 3.1%CVE-2022-22771CRITICALTIBCO JasperReports Library Directory Traversal VulnerabilityEPSS 2.4%