Multiple vulnerabilities in TIBCO JasperReports Server



Published: 2021-10-13
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2021-35494
CVE-2021-35495
CVE-2021-35496
CWE-ID CWE-362
CWE-284
CWE-611
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		TIBCO JasperReports Server
Web applications / Other software

TIBCO JasperReports Server - Community Edition
Server applications / Other server solutions

TIBCO JasperReports Server - Developer Edition
Server applications / Other server solutions

TIBCO JasperReports Server for AWS Marketplace
Server applications / Other server solutions

TIBCO JasperReports Server for ActiveMatrix BPM
Server applications / Other server solutions

TIBCO JasperReports Server for Microsoft Azure
Server applications / Other server solutions

Vendor JasperSoft
TIBCO

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Race condition

EUVDB-ID: #VU57325

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35494

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to a race condition in the Rest API component. A remote authenticated attacker can exploit the race and obtain read access to temporary objects.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

TIBCO JasperReports Server: 4.7 - 7.9.0

TIBCO JasperReports Server - Community Edition: 7.8.0

TIBCO JasperReports Server - Developer Edition: 7.9.0

TIBCO JasperReports Server for AWS Marketplace: 7.9.0

TIBCO JasperReports Server for ActiveMatrix BPM: 7.9.0

TIBCO JasperReports Server for Microsoft Azure: 7.8.0

External links

http://www.tibco.com/services/support/advisories
http://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU57326

Risk: Medium

CVSSv3.1: 7.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35495

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Scheduler Connection component. A remote authenticated attacker can bypass implemented security restrictions and obtain FTP server passwords for other users of the affected system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

TIBCO JasperReports Server: 4.7 - 7.9.0

TIBCO JasperReports Server - Community Edition: 7.8.0

TIBCO JasperReports Server - Developer Edition: 7.9.0

TIBCO JasperReports Server for AWS Marketplace: 7.9.0

TIBCO JasperReports Server for ActiveMatrix BPM: 7.9.0

TIBCO JasperReports Server for Microsoft Azure: 7.8.0

External links

http://www.tibco.com/services/support/advisories
http://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) XML External Entity injection

EUVDB-ID: #VU57327

Risk: Medium

CVSSv3.1: 4 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35496

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied XML input in the XMLA Connections component. A remote authenticated attacker can gain unauthorized read access, as well as unauthorized update, insert or delete access to a subset of the affected systems data and cause a denial of servie (DoS) condition.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

TIBCO JasperReports Server: 4.7 - 7.9.0

TIBCO JasperReports Server - Community Edition: 7.8.0

TIBCO JasperReports Server - Developer Edition: 7.9.0

TIBCO JasperReports Server for AWS Marketplace: 7.9.0

TIBCO JasperReports Server for ActiveMatrix BPM: 7.9.0

TIBCO JasperReports Server for Microsoft Azure: 7.8.0

External links

http://www.tibco.com/services/support/advisories
http://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35496


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###