Vulnerability-Lookup

TIBCO-2021-044

Vulnerability from csaf_tibco - Published: 2021-10-12 17:00 - Updated: 2021-11-02 17:00

Summary

TIBCO Security Advisory TIBCO-2021-044

Notes

Frequently Asked Questions: # FREQUENTLY ASKED QUESTIONS ## Why is this advisory being issued? Security vulnerabilities have been discovered in: * TIBCO JasperReports® Server versions 7.2.1 and below, 7.5.0, 7.5.1, 7.8.0, and 7.9.0 * TIBCO JasperReports® Server - Community Edition versions 7.8.0 and below * TIBCO JasperReports® Server - Developer Edition versions 7.9.0 and below * TIBCO JasperReports® Server for AWS Marketplace versions 7.9.0 and below * TIBCO JasperReports® Server for ActiveMatrix® BPM versions 7.9.0 and below * TIBCO JasperReports® Server for Microsoft Azure version 7.8.0 ## What is the impact of these vulnerabilities? For detailed information on the vulnerability, please see the [security advisory](https://www.tibco.com/services/support/advisories). ## Which customers are affected? These issues affect all customers using the above product versions. ## Where can I get software updates? Customers with current maintenance for the affected products can obtain product updates through their standard TIBCO fulfillment channel, via the Community site, the AWS Marketplace or the Azure Marketplace as appropriate. ## How will customers who receive TIBCO software via OEM partners be affected? Customers of OEM partners can receive new versions and hot fixes from their OEM partners. Please contact your OEM partner for updates. ## Can I get the software update if I am not current on maintenance, if I do not have access to the download site or access to TIBCO support? Please contact us through [this online form](https://www.tibco.com/contact-us), and we will get in touch with you. Please reference CASE ID: 01953922 in your communication to indicate the context of your request. ## What is tibco doing to prevent future security issues? TIBCO takes security very seriously. We perform rigorous testing for every product release, as well as code audits, structured walkthroughs and peer reviews. TIBCO has identified security vulnerabilities in products during internal testing and reviews and corrected them prior to release. TIBCO constantly evaluates and augments its security measures and will continue to do so. ## Where can I get more information? Product advisories can be accessed from the [Security Advisories for TIBCO Products](https://www.tibco.com/services/support/advisories) web page. Customers with a current maintenance contract with TIBCO can log a case with TIBCO Global Support (please refer to the service request identifier listed above) and then call your support telephone number. Maintenance customers can also view product-specific Late Breaking News through the TIBCO Support Web.

CVE-2021-35494

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected products

Fixed 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

Known affected 10 products

Product	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	<=7.2.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.8.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.9.0	Vendor Fix fix
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition	<=7.8.0	Vendor Fix fix
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure	7.8.0	Vendor Fix fix

Recommended 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

CVE-2021-35495

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected products

Fixed 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

Known affected 10 products

Product	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	<=7.2.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.8.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.9.0	Vendor Fix fix
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition	<=7.8.0	Vendor Fix fix
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure	7.8.0	Vendor Fix fix

Recommended 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

CVE-2021-35496

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

Known affected 10 products

Product	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	<=7.2.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.5.1	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.8.0	Vendor Fix fix
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server	7.9.0	Vendor Fix fix
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition	<=7.8.0	Vendor Fix fix
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace	<=7.9.0	Vendor Fix fix
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure	7.8.0	Vendor Fix fix

Recommended 9 products

Product	Identifier	Version	Remediation
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.2.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.5.2
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.8.1
TIBCO JasperReports Server TIBCO Software Inc. / TIBCO JasperReports Server		7.9.1
TIBCO JasperReports Server - Community Edition TIBCO Software Inc. / TIBCO JasperReports Server - Community Edition		7.8.1
TIBCO JasperReports Server - Developer Edition TIBCO Software Inc. / TIBCO JasperReports Server - Developer Edition		7.9.1
TIBCO JasperReports Server for ActiveMatrix BPM TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM		7.9.1
TIBCO JasperReports Server for AWS Marketplace TIBCO Software Inc. / TIBCO JasperReports Server for AWS Marketplace		7.9.1
TIBCO JasperReports Server for Microsoft Azure TIBCO Software Inc. / TIBCO JasperReports Server for Microsoft Azure		7.9.1

References

1 reference

URL	Category
https://www.tibco.com/services/support/advisories	external

Acknowledgments

CODE WHITE GmbH Dr. Florian Hauser

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "audience": "all",
        "category": "faq",
        "text": "# FREQUENTLY ASKED QUESTIONS\n\n## Why is this advisory being issued?\n\nSecurity vulnerabilities have been discovered in:\n\n* TIBCO JasperReports\u00ae Server versions 7.2.1 and below, 7.5.0, 7.5.1, 7.8.0, and 7.9.0\n* TIBCO JasperReports\u00ae Server - Community Edition versions 7.8.0 and below\n* TIBCO JasperReports\u00ae Server - Developer Edition versions 7.9.0 and below\n* TIBCO JasperReports\u00ae Server for AWS Marketplace versions 7.9.0 and below\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM versions 7.9.0 and below\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.8.0\n\n## What is the impact of these vulnerabilities?\n\nFor detailed information on the vulnerability, please see the\n[security advisory](https://www.tibco.com/services/support/advisories).\n\n## Which customers are affected?\n\nThese issues affect all customers using the above product versions.\n\n## Where can I get software updates?\n\nCustomers with current maintenance for the affected products can obtain product updates\nthrough their standard TIBCO fulfillment channel, via the Community site, the AWS Marketplace or\nthe Azure Marketplace as appropriate.\n\n## How will customers who receive TIBCO software via OEM partners be affected?\n\nCustomers of OEM partners can receive new versions and hot fixes from their OEM partners.\nPlease contact your OEM partner for updates.\n\n## Can I get the software update if I am not current on maintenance, if I do not have access to the download site or access to TIBCO support?\n\nPlease contact us through [this online form](https://www.tibco.com/contact-us),\nand we will get in touch with you. Please reference CASE ID: 01953922 in your\ncommunication to indicate the context of your request.\n\n## What is tibco doing to prevent future security issues?\n\nTIBCO takes security very seriously. We perform rigorous testing for every product release,\nas well as code audits, structured walkthroughs and peer reviews. TIBCO has identified\nsecurity vulnerabilities in products during internal testing and reviews and corrected them\nprior to release. TIBCO constantly evaluates and augments its security measures and will\ncontinue to do so.\n\n## Where can I get more information?\n\nProduct advisories can be accessed from the\n[Security Advisories for TIBCO Products](https://www.tibco.com/services/support/advisories) web page.\n\nCustomers with a current maintenance contract with TIBCO can log a case with TIBCO Global Support\n(please refer to the service request identifier listed above) and then call your support telephone number.\nMaintenance customers can also view product-specific Late Breaking News through the TIBCO Support Web.\n\n",
        "title": "Frequently Asked Questions"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "TIBCO Software Inc. can be reached at mailto:security@tibco.com, or via our website at https://www.tibco.com/security",
      "name": "TIBCO PSIRT",
      "namespace": "https://tibco.com"
    },
    "title": "TIBCO Security Advisory TIBCO-2021-044",
    "tracking": {
      "current_release_date": "2021-11-02T17:00:00Z",
      "generator": {
        "date": "2022-07-14T21:43:09Z",
        "engine": {
          "name": "retro-csaf",
          "version": "v3.2.5-0-g741be4e"
        }
      },
      "id": "TIBCO-2021-044",
      "initial_release_date": "2021-10-12T17:00:00Z",
      "revision_history": [
        {
          "date": "2021-10-12T17:00:00Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.2.2",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-69441ff11b1fe32a"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.2.1",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-316e72650f79b10c"
                }
              },
              {
                "category": "product_version",
                "name": "7.5.2",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-e79056930115ffdb"
                }
              },
              {
                "category": "product_version",
                "name": "7.5.0",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-e2110c85a395e533"
                }
              },
              {
                "category": "product_version",
                "name": "7.5.1",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-7faf2aa25caff589"
                }
              },
              {
                "category": "product_version",
                "name": "7.8.1",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-ce271519d5c9a7a2"
                }
              },
              {
                "category": "product_version",
                "name": "7.8.0",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-ff24aa8a71f5804c"
                }
              },
              {
                "category": "product_version",
                "name": "7.9.1",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-30a2344c57bb2cef"
                }
              },
              {
                "category": "product_version",
                "name": "7.9.0",
                "product": {
                  "name": "TIBCO JasperReports Server",
                  "product_id": "tib-1b73d2b202bf7931"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.8.1",
                "product": {
                  "name": "TIBCO JasperReports Server - Community Edition",
                  "product_id": "tib-7b3346315fc28e32"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.8.0",
                "product": {
                  "name": "TIBCO JasperReports Server - Community Edition",
                  "product_id": "tib-97abe203ffb6f2f5"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server - Community Edition"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.9.1",
                "product": {
                  "name": "TIBCO JasperReports Server - Developer Edition",
                  "product_id": "tib-ad86b8fd1259f7bf"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.9.0",
                "product": {
                  "name": "TIBCO JasperReports Server - Developer Edition",
                  "product_id": "tib-48809ba807c9fa0a"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server - Developer Edition"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.9.1",
                "product": {
                  "name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                  "product_id": "tib-9585ed15f6ca8244"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.9.0",
                "product": {
                  "name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                  "product_id": "tib-201e106d7711bfdc"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server for ActiveMatrix BPM"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.9.1",
                "product": {
                  "name": "TIBCO JasperReports Server for AWS Marketplace",
                  "product_id": "tib-2a24744144c662c4"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.9.0",
                "product": {
                  "name": "TIBCO JasperReports Server for AWS Marketplace",
                  "product_id": "tib-4ccd44a41406df28"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server for AWS Marketplace"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "7.9.1",
                "product": {
                  "name": "TIBCO JasperReports Server for Microsoft Azure",
                  "product_id": "tib-96e23a09dd60e7ea"
                }
              },
              {
                "category": "product_version",
                "name": "7.8.0",
                "product": {
                  "name": "TIBCO JasperReports Server for Microsoft Azure",
                  "product_id": "tib-6af4ce922d119a13"
                }
              }
            ],
            "category": "product_name",
            "name": "TIBCO JasperReports Server for Microsoft Azure"
          }
        ],
        "category": "vendor",
        "name": "TIBCO Software Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-35494",
      "involvements": [
        {
          "date": "2021-10-12T17:00:00Z",
          "party": "vendor",
          "status": "completed"
        }
      ],
      "notes": [
        {
          "audience": "all",
          "category": "faq",
          "text": "## TIBCO JasperReports\u00ae Server\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server versions 7.2.1 and below, 7.5.0, 7.5.1, 7.8.0, and 7.9.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server versions 7.2.2, 7.5.2, 7.8.1, and 7.9.1\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Community Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Community Edition versions 7.8.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Community Edition version 7.8.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Developer Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Developer Edition versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Developer Edition version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for AWS Marketplace\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for Microsoft Azure\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.8.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n",
          "title": "Frequently Asked Questions"
        },
        {
          "audience": "all",
          "category": "summary",
          "text": "The components listed above contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ],
        "known_affected": [
          "tib-316e72650f79b10c",
          "tib-e2110c85a395e533",
          "tib-7faf2aa25caff589",
          "tib-ff24aa8a71f5804c",
          "tib-1b73d2b202bf7931",
          "tib-97abe203ffb6f2f5",
          "tib-48809ba807c9fa0a",
          "tib-201e106d7711bfdc",
          "tib-4ccd44a41406df28",
          "tib-6af4ce922d119a13"
        ],
        "recommended": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Additional Information",
          "url": "https://www.tibco.com/services/support/advisories"
        }
      ],
      "release_date": "2021-10-12T17:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-316e72650f79b10c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-ff24aa8a71f5804c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-1b73d2b202bf7931"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-97abe203ffb6f2f5"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-48809ba807c9fa0a"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-201e106d7711bfdc"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-4ccd44a41406df28"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-6af4ce922d119a13"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "tib-316e72650f79b10c",
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589",
            "tib-ff24aa8a71f5804c",
            "tib-1b73d2b202bf7931",
            "tib-97abe203ffb6f2f5",
            "tib-48809ba807c9fa0a",
            "tib-201e106d7711bfdc",
            "tib-4ccd44a41406df28",
            "tib-6af4ce922d119a13"
          ]
        }
      ],
      "title": "TIBCO JasperReports unauthorized access to temporary object"
    },
    {
      "cve": "CVE-2021-35495",
      "involvements": [
        {
          "date": "2021-10-12T17:00:00Z",
          "party": "vendor",
          "status": "completed"
        }
      ],
      "notes": [
        {
          "audience": "all",
          "category": "faq",
          "text": "## TIBCO JasperReports\u00ae Server\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server versions 7.2.1 and below, 7.5.0, 7.5.1, 7.8.0, and 7.9.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server versions 7.2.2, 7.5.2, 7.8.1, and 7.9.1\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Community Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Community Edition versions 7.8.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Community Edition version 7.8.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Developer Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Developer Edition versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Developer Edition version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for AWS Marketplace\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for Microsoft Azure\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.8.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n",
          "title": "Frequently Asked Questions"
        },
        {
          "audience": "all",
          "category": "summary",
          "text": "The component listed above contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ],
        "known_affected": [
          "tib-316e72650f79b10c",
          "tib-e2110c85a395e533",
          "tib-7faf2aa25caff589",
          "tib-ff24aa8a71f5804c",
          "tib-1b73d2b202bf7931",
          "tib-97abe203ffb6f2f5",
          "tib-48809ba807c9fa0a",
          "tib-201e106d7711bfdc",
          "tib-4ccd44a41406df28",
          "tib-6af4ce922d119a13"
        ],
        "recommended": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Additional Information",
          "url": "https://www.tibco.com/services/support/advisories"
        }
      ],
      "release_date": "2021-10-12T17:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-316e72650f79b10c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-ff24aa8a71f5804c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-1b73d2b202bf7931"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-97abe203ffb6f2f5"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-48809ba807c9fa0a"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-201e106d7711bfdc"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-4ccd44a41406df28"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-6af4ce922d119a13"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "tib-316e72650f79b10c",
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589",
            "tib-ff24aa8a71f5804c",
            "tib-1b73d2b202bf7931",
            "tib-97abe203ffb6f2f5",
            "tib-48809ba807c9fa0a",
            "tib-201e106d7711bfdc",
            "tib-4ccd44a41406df28",
            "tib-6af4ce922d119a13"
          ]
        }
      ],
      "title": "TIBCO JasperReports FTP Password exposed"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Dr. Florian Hauser"
          ],
          "organization": "CODE WHITE GmbH"
        }
      ],
      "cve": "CVE-2021-35496",
      "involvements": [
        {
          "date": "2021-10-12T17:00:00Z",
          "party": "vendor",
          "status": "completed"
        }
      ],
      "notes": [
        {
          "audience": "all",
          "category": "faq",
          "text": "## TIBCO JasperReports\u00ae Server\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server versions 7.2.1 and below, 7.5.0, 7.5.1, 7.8.0, and 7.9.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server versions 7.2.2, 7.5.2, 7.8.1, and 7.9.1\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Community Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Community Edition versions 7.8.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Community Edition version 7.8.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server - Developer Edition\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server - Developer Edition versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server - Developer Edition version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for AWS Marketplace\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for AWS Marketplace version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM versions 7.9.0 and below\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for ActiveMatrix\u00ae BPM version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n## TIBCO JasperReports\u00ae Server for Microsoft Azure\n\n### Which product versions are affected?\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.8.0\n\n### Which component is affected?\n\n* XMLA Connections\n\n### How should customers handle these issues?\n\nFor each affected system, customers should update to the corresponding software versions:\n\n* TIBCO JasperReports\u00ae Server for Microsoft Azure version 7.9.1 or later\n\nPlease follow the instructions in the product installation manual.\n\n### What is updated by this new product version?\nPlease see the readme, release notes and/or documentation for a complete list of changes.\n\n\n",
          "title": "Frequently Asked Questions"
        },
        {
          "audience": "all",
          "category": "summary",
          "text": "The component listed above contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "fixed": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ],
        "known_affected": [
          "tib-316e72650f79b10c",
          "tib-e2110c85a395e533",
          "tib-7faf2aa25caff589",
          "tib-ff24aa8a71f5804c",
          "tib-1b73d2b202bf7931",
          "tib-97abe203ffb6f2f5",
          "tib-48809ba807c9fa0a",
          "tib-201e106d7711bfdc",
          "tib-4ccd44a41406df28",
          "tib-6af4ce922d119a13"
        ],
        "recommended": [
          "tib-69441ff11b1fe32a",
          "tib-e79056930115ffdb",
          "tib-ce271519d5c9a7a2",
          "tib-30a2344c57bb2cef",
          "tib-7b3346315fc28e32",
          "tib-ad86b8fd1259f7bf",
          "tib-9585ed15f6ca8244",
          "tib-2a24744144c662c4",
          "tib-96e23a09dd60e7ea"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Additional Information",
          "url": "https://www.tibco.com/services/support/advisories"
        }
      ],
      "release_date": "2021-10-12T17:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-316e72650f79b10c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-ff24aa8a71f5804c"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-1b73d2b202bf7931"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-97abe203ffb6f2f5"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-48809ba807c9fa0a"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-201e106d7711bfdc"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-4ccd44a41406df28"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-12T17:00:00Z",
          "details": "Upgrade the affected component or components to the recommended version or later.",
          "entitlements": [
            "current maintenance",
            "out of maintenance, contact with CASE ID: 01953922"
          ],
          "product_ids": [
            "tib-6af4ce922d119a13"
          ],
          "restart_required": {
            "category": "vulnerable_component"
          },
          "url": "https://edelivery.tibco.com/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "tib-316e72650f79b10c",
            "tib-e2110c85a395e533",
            "tib-7faf2aa25caff589",
            "tib-ff24aa8a71f5804c",
            "tib-1b73d2b202bf7931",
            "tib-97abe203ffb6f2f5",
            "tib-48809ba807c9fa0a",
            "tib-201e106d7711bfdc",
            "tib-4ccd44a41406df28",
            "tib-6af4ce922d119a13"
          ]
        }
      ],
      "title": "TIBCO JasperReports XML Eternal Entity (XXE) vulnerability"
    }
  ]
}

CVE-2021-35494 (GCVE-0-2021-35494)

Vulnerability from cvelistv5 – Published: 2021-10-12 17:35 – Updated: 2024-09-17 00:51

Title

TIBCO JasperReports unauthorized access to temporary object

Summary

The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

Successful execution of this vulnerability results in the attacker gaining unauthorized read access to the data of other users on the affected system.

Assigner

tibco

References

2 references

URL	Tags
https://www.tibco.com/services/support/advisories	x_refsource_CONFIRM
https://www.tibco.com/support/advisories/2021/10/…	x_refsource_CONFIRM

Impacted products

9 products

Vendor	Product	Version
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: unspecified , ≤ 7.2.1 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.5.0 Affected: 7.5.1
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.8.0
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.9.0
TIBCO Software Inc.	TIBCO JasperReports Server - Community Edition	Affected: unspecified , ≤ 7.8.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server - Developer Edition	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for AWS Marketplace	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for Microsoft Azure	Affected: 7.8.0

Date Public

2021-10-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/services/support/advisories"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.5.1"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Community Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.8.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Developer Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for AWS Marketplace",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for Microsoft Azure",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        }
      ],
      "datePublic": "2021-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Rest API component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Successful execution of this vulnerability results in the attacker gaining unauthorized read access to the data of other users on the affected system.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-12T18:06:12.000Z",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/services/support/advisories"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO JasperReports unauthorized access to temporary object",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2021-10-12T17:00:00Z",
          "ID": "CVE-2021-35494",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO JasperReports unauthorized access to temporary object"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.2.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.5.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.5.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Community Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Developer Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for AWS Marketplace",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for Microsoft Azure",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Rest API component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Successful execution of this vulnerability results in the attacker gaining unauthorized read access to the data of other users on the affected system."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tibco.com/services/support/advisories",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/services/support/advisories"
            },
            {
              "name": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2021-35494",
    "datePublished": "2021-10-12T17:35:11.042Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2024-09-17T00:51:58.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35495 (GCVE-0-2021-35495)

Vulnerability from cvelistv5 – Published: 2021-10-12 17:35 – Updated: 2024-09-16 18:12

Title

TIBCO JasperReports FTP Password exposed

Summary

The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Severity

9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

Successful execution of this vulnerability can result in an attacker gaining access to the victim’s FTP server at the privilege level of the victim.

Assigner

tibco

References

2 references

URL	Tags
https://www.tibco.com/services/support/advisories	x_refsource_CONFIRM
https://www.tibco.com/support/advisories/2021/10/…	x_refsource_CONFIRM

Impacted products

9 products

Vendor	Product	Version
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: unspecified , ≤ 7.2.1 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.5.0 Affected: 7.5.1
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.8.0
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.9.0
TIBCO Software Inc.	TIBCO JasperReports Server - Community Edition	Affected: unspecified , ≤ 7.8.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server - Developer Edition	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for AWS Marketplace	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for Microsoft Azure	Affected: 7.8.0

Date Public

2021-10-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/services/support/advisories"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.5.1"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Community Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.8.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Developer Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for AWS Marketplace",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for Microsoft Azure",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        }
      ],
      "datePublic": "2021-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Scheduler Connection component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Successful execution of this vulnerability can result in an attacker gaining access to the victim\u2019s FTP server at the privilege level of the victim.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-12T18:06:15.000Z",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/services/support/advisories"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "TIBCO JasperReports FTP Password exposed",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2021-10-12T17:00:00Z",
          "ID": "CVE-2021-35495",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO JasperReports FTP Password exposed"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.2.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.5.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.5.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Community Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Developer Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for AWS Marketplace",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for Microsoft Azure",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Scheduler Connection component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Successful execution of this vulnerability can result in an attacker gaining access to the victim\u2019s FTP server at the privilege level of the victim."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tibco.com/services/support/advisories",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/services/support/advisories"
            },
            {
              "name": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
          }
        ],
        "source": {
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2021-35495",
    "datePublished": "2021-10-12T17:35:12.623Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:12:56.880Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35496 (GCVE-0-2021-35496)

Vulnerability from cvelistv5 – Published: 2021-10-12 17:35 – Updated: 2024-09-17 03:43

Title

TIBCO JasperReports XML Eternal Entity (XXE) vulnerability

Summary

The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to the affected systems data and the ability to cause a denial of service (DOS) on the affected system.

Assigner

tibco

References

1 reference

URL	Tags
https://www.tibco.com/services/support/advisories	x_refsource_CONFIRM

Impacted products

9 products

Vendor	Product	Version
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: unspecified , ≤ 7.2.1 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.5.0 Affected: 7.5.1
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.8.0
TIBCO Software Inc.	TIBCO JasperReports Server	Affected: 7.9.0
TIBCO Software Inc.	TIBCO JasperReports Server - Community Edition	Affected: unspecified , ≤ 7.8.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server - Developer Edition	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for AWS Marketplace	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	Affected: unspecified , ≤ 7.9.0 (custom)
TIBCO Software Inc.	TIBCO JasperReports Server for Microsoft Azure	Affected: 7.8.0

Date Public

2021-10-12 00:00

Credits

TIBCO would like to extend its appreciation to Dr. Florian Hauser, CODE WHITE GmbH for discovery of this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/services/support/advisories"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0"
            },
            {
              "status": "affected",
              "version": "7.5.1"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Community Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.8.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server - Developer Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for AWS Marketplace",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "lessThanOrEqual": "7.9.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for Microsoft Azure",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "7.8.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "TIBCO would like to extend its appreciation to Dr. Florian Hauser, CODE WHITE GmbH for discovery of this vulnerability."
        }
      ],
      "datePublic": "2021-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The XMLA Connections component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to the affected systems data and the ability to cause a denial of service (DOS) on the affected system.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-11-02T19:06:05.000Z",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/services/support/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
        }
      ],
      "source": {
        "discovery": "Dr. Florian Hauser, CODE WHITE GmbH"
      },
      "title": "TIBCO JasperReports XML Eternal Entity (XXE) vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2021-10-12T17:00:00Z",
          "ID": "CVE-2021-35496",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO JasperReports XML Eternal Entity (XXE) vulnerability",
          "UPDATED": "2021-11-02T17:00:00Z"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.2.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.5.0"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.5.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Community Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server - Developer Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for AWS Marketplace",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "7.9.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for Microsoft Azure",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.8.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "TIBCO would like to extend its appreciation to Dr. Florian Hauser, CODE WHITE GmbH for discovery of this vulnerability."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The XMLA Connections component of TIBCO Software Inc.\u0027s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.\u0027s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to the affected systems data and the ability to cause a denial of service (DOS) on the affected system."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tibco.com/services/support/advisories",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/services/support/advisories"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"
          }
        ],
        "source": {
          "discovery": "Dr. Florian Hauser, CODE WHITE GmbH"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2021-35496",
    "datePublished": "2021-10-12T17:35:14.158Z",
    "dateReserved": "2021-06-24T00:00:00.000Z",
    "dateUpdated": "2024-09-17T03:43:38.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

TIBCO-2021-044

CVE-2021-35494 (GCVE-0-2021-35494)

CVE-2021-35495 (GCVE-0-2021-35495)

CVE-2021-35496 (GCVE-0-2021-35496)

Tags

Sightings

Nomenclature