CVE-2022-22773

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 17-05-2022 08:15

Last modified: - 25-05-2022 11:45

Total changes: - 3

Description

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Low

Attack complexity

Network

Attack vector

None

Availability

Low

Confidentiality

Low

Integrity

Low

Privileges required

Changed

Scope

Required

User interaction

5.4

Base score

2.3

2.7

Exploitability score

Impact score

Verification logic

vendor=tibco AND product=jasperreports_server AND software_edition=- AND target_software=- AND versionEndExcluding=8.0.2

vendor=tibco AND product=jasperreports_server AND software_edition=developer AND versionEndExcluding=8.0.2

vendor=tibco AND product=jasperreports_server AND software_edition=community AND versionEndExcluding=8.0.2

vendor=tibco AND product=jasperreports_server AND target_software=microsoft_azure AND versionEndExcluding=8.0.2

vendor=tibco AND product=jasperreports_server AND target_software=activematrix_bpm AND versionEndIncluding=7.9.2

vendor=tibco AND product=jasperreports_server AND target_software=aws_marketplace AND versionEndExcluding=8.0.2

Reference

Keywords

CVE-2022-22773

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-22773

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures