Path traversal in JasperSoft products - CVE-2022-22771

Vulnerability identifier: #VU61397

CSH Severity: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2022-22771

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
TIBCO JasperReports Library
TIBCO JasperReports Library for ActiveMatrix BPM
TIBCO JasperReports Server
TIBCO JasperReports Server for AWS Marketplace
TIBCO JasperReports Server for ActiveMatrix BPM
TIBCO JasperReports Server for Microsoft Azure

Software vendor:
TIBCO
JasperSoft

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Server component. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

Install update from vendor's website.

• https://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771