CVE-2020-9409 — Incorrect Default Permissions in Software INC Tibco Jasperreports Server

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
3.1%
top 13.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Tibco Software INC Tibco Jasperreports ServerTibco Software INC Tibco Jasperreports Server FOR Activematrix BPMTibco Software INC Tibco Jasperreports Server FOR AWS Marketplace+2 more
Timeline
PublishedMay 20
Latest updateMay 24

Description

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5tibco_software_inc/tibco_jasperreports_serverunspecified — 7.1.1
▶NVDoracle/retail_order_broker15.0, 16.0+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j2v4-xwh5-47fc: The administrative UI component of TIBCO Software Inc↗2022-05-24
▶
CVEList
TIBCO JasperReports Server Fails To Enforce Access Restrictions↗2020-05-20
▶
CVE-2020-9409 — Incorrect Default Permissions | cvebase