CVE-2020-9410
published 2020-05-20CVE-2020-9410: The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports…
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
5.06%
91.3th percentile
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions 7.1.1 and below, versions 7.2.0 and 7.2.1, version 7.3.0, version 7.5.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions 7.1.1 and below, TIBCO JasperReports Server: versions 7.1.1 and below, version 7.2.0, version 7.5.0, TIBCO JasperReports Server for AWS Marketplace: versions 7.5.0 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | retail_order_broker | — | — |
| oracle | retail_order_broker | — | — |
| tibco | jasperreports_library | <= 7.1.1 | — |
| tibco | jasperreports_library | — | — |
| tibco | jasperreports_library | — | — |
| tibco | jasperreports_library | — | — |
| tibco | jasperreports_library | — | — |
| tibco | jasperreports_server | <= 7.1.1 | — |
| tibco | jasperreports_server | <= 7.5.0 | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_library | — | — |
| tibco_software_inc | tibco_jasperreports_library | — | — |
| tibco_software_inc | tibco_jasperreports_library | — | — |
| tibco_software_inc | tibco_jasperreports_library | — | — |
| tibco_software_inc | tibco_jasperreports_library | unspecified – 7.1.1 | — |
| tibco_software_inc | tibco_jasperreports_library_for_activematrix_bpm | unspecified – 7.1.1 | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | unspecified – 7.1.1 | — |
| tibco_software_inc | tibco_jasperreports_server_for_activematrix_bpm | unspecified – 7.1.1 | — |
| tibco_software_inc | tibco_jasperreports_server_for_aws_marketplace | unspecified – 7.5.0 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_oracle8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Order Broker Foundation (jasperreports_server) — CVE-2020-9410
vendor_oracle·2020-10-15·CVSS 8.8
CVE-2020-9410 [HIGH] Oracle Oracle Retail Applications Risk Matrix: Order Broker Foundation (jasperreports_server) — CVE-2020-9410
Oracle Oracle Retail Applications Risk Matrix: Order Broker Foundation (jasperreports_server) vulnerability
CVE: CVE-2020-9410
CVSS: 8.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
GHSA
GHSA-jcfp-678f-37q2: The report generator component of TIBCO Software Inc
ghsa_unreviewed·2022-05-24
CVE-2020-9410 [MEDIUM] CWE-74 GHSA-jcfp-678f-37q2: The report generator component of TIBCO Software Inc
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: ve
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-05-20
Published