Main Vulnerability Database Vulnerabilities #VU28111

Improper access control in JasperSoft products - CVE-2020-9409

Published: May 20, 2020

Vulnerability identifier: #VU28111

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9409

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in "administrative UI" component. A remote attacker can obtain a "superuser" permission, bypass implemented security restrictions and gain unauthorized access to the application, leading to arbitrary code execution.

Affected software

TIBCO JasperReports Server for AWS Marketplace
TIBCO JasperReports Server for ActiveMatrix BPM
TIBCO JasperReports Server

How to mitigate CVE-2020-9409

Install updates from vendor's website.

TIBCO JasperReports Server for AWS Marketplace - update to 7.2.0
TIBCO JasperReports Server for ActiveMatrix BPM - update to 7.1.3
TIBCO JasperReports Server - update to 7.1.3

External References

https://www.tibco.com/support/advisories/2020/05/tibco-security-advisory-may-19-2020-tibco-jasperreports-server

Related Security Bulletins