SB2021101309 - Multiple vulnerabilities in TIBCO JasperReports Server

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Race condition (CVE-ID: CVE-2021-35494)

The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to a race condition in the Rest API component. A remote authenticated attacker can exploit the race and obtain read access to temporary objects.

2) Improper access control (CVE-ID: CVE-2021-35495)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the Scheduler Connection component. A remote authenticated attacker can bypass implemented security restrictions and obtain FTP server passwords for other users of the affected system.

3) XML External Entity injection (CVE-ID: CVE-2021-35496)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied XML input in the XMLA Connections component. A remote authenticated attacker can gain unauthorized read access, as well as unauthorized update, insert or delete access to a subset of the affected systems data and cause a denial of servie (DoS) condition.

Remediation

Install update from vendor's website.

References

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495
• https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35496