CVE-2020-9410: TIBCO JasperReports Library
First published: Tue May 19 2020(Updated: )
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions 7.1.1 and below, versions 7.2.0 and 7.2.1, version 7.3.0, version 7.5.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions 7.1.1 and below, TIBCO JasperReports Server: versions 7.1.1 and below, version 7.2.0, version 7.5.0, TIBCO JasperReports Server for AWS Marketplace: versions 7.5.0 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tibco Jasperreports Library | <=7.1.1 | |
| Tibco Jasperreports Library | <=7.1.1 | |
| Tibco Jasperreports Library | =7.2.0 | |
| Tibco Jasperreports Library | =7.2.1 | |
| Tibco Jasperreports Library | =7.3.0 | |
| Tibco Jasperreports Library | =7.5.0 | |
| TIBCO JasperReports Server - | <=7.1.1 | |
| Tibco Jasperreports Server | <=7.1.1 | |
| Tibco Jasperreports Server | <=7.5.0 | |
| Tibco Jasperreports Server | =7.2.0 | |
| Tibco Jasperreports Server | =7.5.0 | |
| Oracle Retail Order Broker | =15.0 | |
| Oracle Retail Order Broker | =16.0 |
Remedy
TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Library versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Library versions 7.2.0 and 7.2.1 update to version 7.2.2 or higher TIBCO JasperReports Library version 7.3.0 update to version 7.3.1 or higher TIBCO JasperReports Library version 7.5.0 update to version 7.5.1 or higher TIBCO JasperReports Library for ActiveMatrix BPM versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Server versions 7.1.1 and below update to version 7.1.3 or higher TIBCO JasperReports Server version 7.2.0 update to version 7.2.1 or higher TIBCO JasperReports Server version 7.5.0 update to version 7.5.1 or higher TIBCO JasperReports Server for AWS Marketplace versions 7.5.0 and below update to version 7.5.1 or higher TIBCO JasperReports Server for ActiveMatrix BPM versions 7.1.1 and below update to version 7.1.3 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-9410?
The severity of CVE-2020-9410 is high, with a severity value of 8.8.
Which software is affected by CVE-2020-9410?
CVE-2020-9410 affects TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM.
What is the vulnerability description of CVE-2020-9410?
CVE-2020-9410 is a vulnerability found in the report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library and other related products, which allows for theoretical exploitation.
How do I fix CVE-2020-9410?
To fix CVE-2020-9410, it is recommended to upgrade to a version that is not affected by the vulnerability.
Where can I find more information about CVE-2020-9410?
More information about CVE-2020-9410 can be found in the advisories provided by TIBCO Software Inc. and Oracle's security alerts.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/tags
- agent/first-publish-date
- agent/description
- vendor/tibco
- canonical/tibco jasperreports library
- version/tibco jasperreports library/7.1.1
- version/tibco jasperreports library/7.2.0
- version/tibco jasperreports library/7.2.1
- version/tibco jasperreports library/7.3.0
- version/tibco jasperreports library/7.5.0
- canonical/tibco jasperreports server -
- version/tibco jasperreports server -/7.1.1
- canonical/tibco jasperreports server
- version/tibco jasperreports server/7.1.1
- version/tibco jasperreports server/7.5.0
- version/tibco jasperreports server/7.2.0
- vendor/oracle
- canonical/oracle retail order broker
- version/oracle retail order broker/15.0
- version/oracle retail order broker/16.0