cbcvebase.
CVE-2021-35496
published 2021-10-12

CVE-2021-35496: The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports…

PriorityP343high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.62%
45.2th percentile
The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Affected

17 ranges
VendorProductVersion rangeFixed in
tibcojasperreports_server<= 7.2.1—
tibcojasperreports_server<= 7.8.0—
tibcojasperreports_server<= 7.9.0—
tibcojasperreports_server——
tibcojasperreports_server——
tibcojasperreports_server——
tibcojasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_serverunspecified – 7.2.1—
tibco_software_inctibco_jasperreports_server_community_editionunspecified – 7.8.0—
tibco_software_inctibco_jasperreports_server_developer_editionunspecified – 7.9.0—
tibco_software_inctibco_jasperreports_server_for_activematrix_bpmunspecified – 7.9.0—
tibco_software_inctibco_jasperreports_server_for_aws_marketplaceunspecified – 7.9.0—
tibco_software_inctibco_jasperreports_server_for_microsoft_azure——

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.