CVE-2021-35495 - Vulnerability Details

Vendors	Products
Tibco	Jasperreports Server

Link	Providers
https://www.tibco.com/services/support/advisories
https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "7.2.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.5.0"}, {"status": "affected", "version": "7.5.1"}]}, {"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.8.0"}]}, {"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.9.0"}]}, {"product": "TIBCO JasperReports Server - Community Edition", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "7.8.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO JasperReports Server - Developer Edition", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "7.9.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO JasperReports Server for AWS Marketplace", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "7.9.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO JasperReports Server for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "7.9.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "TIBCO JasperReports Server for Microsoft Azure", "vendor": "TIBCO Software Inc.", "versions": [{"status": "affected", "version": "7.8.0"}]}], "datePublic": "2021-10-12T00:00:00", "descriptions": [{"lang": "en", "value": "The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Successful execution of this vulnerability can result in an attacker gaining access to the victim\u2019s FTP server at the privilege level of the victim.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-10-12T18:06:15", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"}], "source": {"discovery": "INTERNAL"}, "title": "TIBCO JasperReports FTP Password exposed", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2021-10-12T17:00:00Z", "ID": "CVE-2021-35495", "STATE": "PUBLIC", "TITLE": "TIBCO JasperReports FTP Password exposed"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"version_affected": "<=", "version_value": "7.2.1"}]}}, {"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"version_affected": "=", "version_value": "7.5.0"}, {"version_affected": "=", "version_value": "7.5.1"}]}}, {"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"version_affected": "=", "version_value": "7.8.0"}]}}, {"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"version_affected": "=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Server - Community Edition", "version": {"version_data": [{"version_affected": "<=", "version_value": "7.8.0"}]}}, {"product_name": "TIBCO JasperReports Server - Developer Edition", "version": {"version_data": [{"version_affected": "<=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Server for AWS Marketplace", "version": {"version_data": [{"version_affected": "<=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Server for ActiveMatrix BPM", "version": {"version_data": [{"version_affected": "<=", "version_value": "7.9.0"}]}}, {"product_name": "TIBCO JasperReports Server for Microsoft Azure", "version": {"version_data": [{"version_affected": "=", "version_value": "7.8.0"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Successful execution of this vulnerability can result in an attacker gaining access to the victim\u2019s FTP server at the privilege level of the victim."}]}]}, "references": {"reference_data": [{"name": "https://www.tibco.com/services/support/advisories", "refsource": "CONFIRM", "url": "https://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues.\n\nTIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later\nTIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later\nTIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later\nTIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later\nTIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later\nTIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later\nTIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later"}], "source": {"discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:40:46.345Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2021-35495", "datePublished": "2021-10-12T17:35:12.623465Z", "dateReserved": "2021-06-24T00:00:00", "dateUpdated": "2024-09-16T18:12:56.880Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : TIBCO JasperReports Server (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.2.1 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

1 : { »

product : TIBCO JasperReports Server (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.5.0 (string)

}

1 : { »

status : affected (string)

version : 7.5.1 (string)

}

]

}

2 : { »

product : TIBCO JasperReports Server (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.8.0 (string)

}

]

}

3 : { »

product : TIBCO JasperReports Server (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.9.0 (string)

}

]

}

4 : { »

product : TIBCO JasperReports Server - Community Edition (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.8.0 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

5 : { »

product : TIBCO JasperReports Server - Developer Edition (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.9.0 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

6 : { »

product : TIBCO JasperReports Server for AWS Marketplace (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.9.0 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

7 : { »

product : TIBCO JasperReports Server for ActiveMatrix BPM (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

lessThanOrEqual : 7.9.0 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

8 : { »

product : TIBCO JasperReports Server for Microsoft Azure (string)

vendor : TIBCO Software Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 7.8.0 (string)

}

]

}

]

datePublic : 2021-10-12T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Successful execution of this vulnerability can result in an attacker gaining access to the victim’s FTP server at the privilege level of the victim. (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-10-12T18:06:15 (string)

orgId : 4f830c72-39e4-45f6-a99f-78cc01ae04db (string)

shortName : tibco (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.tibco.com/services/support/advisories (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later TIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later TIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later TIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later TIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later TIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later (string)

}

]

source : { »

discovery : INTERNAL (string)

}

title : TIBCO JasperReports FTP Password exposed (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@tibco.com (string)

DATE_PUBLIC : 2021-10-12T17:00:00Z (string)

ID : CVE-2021-35495 (string)

STATE : PUBLIC (string)

TITLE : TIBCO JasperReports FTP Password exposed (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : TIBCO JasperReports Server (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 7.2.1 (string)

}

]

}

1 : { »

product_name : TIBCO JasperReports Server (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 7.5.0 (string)

}

1 : { »

version_affected : = (string)

version_value : 7.5.1 (string)

}

]

}

2 : { »

product_name : TIBCO JasperReports Server (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 7.8.0 (string)

}

]

}

3 : { »

product_name : TIBCO JasperReports Server (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 7.9.0 (string)

}

]

}

4 : { »

product_name : TIBCO JasperReports Server - Community Edition (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 7.8.0 (string)

}

]

}

5 : { »

product_name : TIBCO JasperReports Server - Developer Edition (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 7.9.0 (string)

}

]

}

6 : { »

product_name : TIBCO JasperReports Server for AWS Marketplace (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 7.9.0 (string)

}

]

}

7 : { »

product_name : TIBCO JasperReports Server for ActiveMatrix BPM (string)

version : { »

version_data : [ »

0 : { »

version_affected : <= (string)

version_value : 7.9.0 (string)

}

]

}

8 : { »

product_name : TIBCO JasperReports Server for Microsoft Azure (string)

version : { »

version_data : [ »

0 : { »

version_affected : = (string)

version_value : 7.8.0 (string)

}

]

}

]

}

vendor_name : TIBCO Software Inc. (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0. (string)

}

]

}

impact : { »

cvss : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (string)

version : 3.0 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Successful execution of this vulnerability can result in an attacker gaining access to the victim’s FTP server at the privilege level of the victim. (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://www.tibco.com/services/support/advisories (string)

refsource : CONFIRM (string)

url : https://www.tibco.com/services/support/advisories (string)

}

1 : { »

name : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

refsource : CONFIRM (string)

url : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

}

]

}

solution : [ »

0 : { »

lang : en (string)

value : TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Server versions 7.2.1 and below update to version 7.2.2 or later TIBCO JasperReports Server versions 7.5.0 and 7.5.1 update to version 7.5.2 or later TIBCO JasperReports Server version 7.8.0 update to version 7.8.1 or later TIBCO JasperReports Server version 7.9.0 update to version 7.9.1 or later TIBCO JasperReports Server - Community Edition versions 7.8.0 and below update to version 7.8.1 or later TIBCO JasperReports Server - Developer Edition versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for AWS Marketplace versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.0 and below update to version 7.9.1 or later TIBCO JasperReports Server for Microsoft Azure version 7.8.0 update to version 7.9.1 or later (string)

}

]

source : { »

discovery : INTERNAL (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T00:40:46.345Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.tibco.com/services/support/advisories (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 4f830c72-39e4-45f6-a99f-78cc01ae04db (string)

assignerShortName : tibco (string)

cveId : CVE-2021-35495 (string)

datePublished : 2021-10-12T17:35:12.623465Z (string)

dateReserved : 2021-06-24T00:00:00 (string)

dateUpdated : 2024-09-16T18:12:56.880Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:-:*:*", "matchCriteriaId": "E87BF137-85ED-436B-B489-BAC6E1EDD4D2", "versionEndIncluding": "7.2.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:microsoft_azure:*:*", "matchCriteriaId": "EC19CCA7-EFDE-4D1F-817A-31E0FC8769CA", "versionEndIncluding": "7.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*", "matchCriteriaId": "DF6B9A0D-3531-44BA-B69B-4E3816FF0A62", "versionEndIncluding": "7.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*", "matchCriteriaId": "460EDE2D-4363-43D1-804E-E13D45CC1D62", "versionEndIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:aws_marketplace:*:*", "matchCriteriaId": "4E99B51D-A190-4819-A8FE-95E26C272ED3", "versionEndIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:developer:*:*:*", "matchCriteriaId": "96707798-F82B-433A-AC20-E59B2711EABF", "versionEndIncluding": "7.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.5.0:*:*:*:*:-:*:*", "matchCriteriaId": "C01DD2E2-BAE8-44E4-A0BE-E60850EF3286", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.5.1:*:*:*:*:-:*:*", "matchCriteriaId": "A3648C6D-345F-482F-ACA9-58F1E3A37591", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.8.0:*:*:*:*:-:*:*", "matchCriteriaId": "0D39A041-5F31-4457-BE1C-B685306DD407", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:*", "matchCriteriaId": "C68AA2D6-C235-48FF-9266-FEFCFDAABC44", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0."}, {"lang": "es", "value": "El componente Scheduler Connection de TIBCO Software Inc. de TIBCO Software Inc., TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server para AWS Marketplace, TIBCO JasperReports Server para ActiveMatrix BPM, y TIBCO JasperReports Server para Microsoft Azure contiene una vulnerabilidad f\u00e1cilmente explotable que permite a un atacante autenticado con acceso a la red obtener las contrase\u00f1as del servidor FTP de otros usuarios del sistema afectado. Las versiones afectadas son TIBCO Software Inc.'s TIBCO JasperReports Server: versiones 7.2.1 y por debajo, TIBCO JasperReports Server: versiones 7.5.0 y 7.5.1, TIBCO JasperReports Server: versi\u00f3n 7.8.0, TIBCO JasperReports Server: versi\u00f3n 7.9.0, TIBCO JasperReports Server - Community Edition: versiones 7.8. 0 y por debajo, TIBCO JasperReports Server - Developer Edition: versiones 7.9.0 y por debajo, TIBCO JasperReports Server para AWS Marketplace: y por debajo, TIBCO JasperReports Server para ActiveMatrix BPM: versiones 7.9.0 y por debajo, y TIBCO JasperReports Server para Microsoft Azure: versi\u00f3n 7.8.0"}], "id": "CVE-2021-35495", "lastModified": "2024-11-21T06:12:22.850", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security@tibco.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-12T18:15:08.260", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:-:*:* (string)

matchCriteriaId : E87BF137-85ED-436B-B489-BAC6E1EDD4D2 (string)

versionEndIncluding : 7.2.1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:microsoft_azure:*:* (string)

matchCriteriaId : EC19CCA7-EFDE-4D1F-817A-31E0FC8769CA (string)

versionEndIncluding : 7.8.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* (string)

matchCriteriaId : DF6B9A0D-3531-44BA-B69B-4E3816FF0A62 (string)

versionEndIncluding : 7.8.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* (string)

matchCriteriaId : 460EDE2D-4363-43D1-804E-E13D45CC1D62 (string)

versionEndIncluding : 7.9.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:aws_marketplace:*:* (string)

matchCriteriaId : 4E99B51D-A190-4819-A8FE-95E26C272ED3 (string)

versionEndIncluding : 7.9.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:developer:*:*:* (string)

matchCriteriaId : 96707798-F82B-433A-AC20-E59B2711EABF (string)

versionEndIncluding : 7.9.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:7.5.0:*:*:*:*:-:*:* (string)

matchCriteriaId : C01DD2E2-BAE8-44E4-A0BE-E60850EF3286 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:7.5.1:*:*:*:*:-:*:* (string)

matchCriteriaId : A3648C6D-345F-482F-ACA9-58F1E3A37591 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:7.8.0:*:*:*:*:-:*:* (string)

matchCriteriaId : 0D39A041-5F31-4457-BE1C-B685306DD407 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:* (string)

matchCriteriaId : C68AA2D6-C235-48FF-9266-FEFCFDAABC44 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains an easily exploitable vulnerability that allows an authenticated attacker with network access to obtain FTP server passwords for other users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0. (string)

}

1 : { »

lang : es (string)

value : El componente Scheduler Connection de TIBCO Software Inc. de TIBCO Software Inc., TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server para AWS Marketplace, TIBCO JasperReports Server para ActiveMatrix BPM, y TIBCO JasperReports Server para Microsoft Azure contiene una vulnerabilidad fácilmente explotable que permite a un atacante autenticado con acceso a la red obtener las contraseñas del servidor FTP de otros usuarios del sistema afectado. Las versiones afectadas son TIBCO Software Inc.'s TIBCO JasperReports Server: versiones 7.2.1 y por debajo, TIBCO JasperReports Server: versiones 7.5.0 y 7.5.1, TIBCO JasperReports Server: versión 7.8.0, TIBCO JasperReports Server: versión 7.9.0, TIBCO JasperReports Server - Community Edition: versiones 7.8. 0 y por debajo, TIBCO JasperReports Server - Developer Edition: versiones 7.9.0 y por debajo, TIBCO JasperReports Server para AWS Marketplace: y por debajo, TIBCO JasperReports Server para ActiveMatrix BPM: versiones 7.9.0 y por debajo, y TIBCO JasperReports Server para Microsoft Azure: versión 7.8.0 (string)

}

]

id : CVE-2021-35495 (string)

lastModified : 2024-11-21T06:12:22.850 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.3 (number)

impactScore : 6 (number)

source : security@tibco.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-10-12T18:15:08.260 (string)

references : [ »

0 : { »

source : security@tibco.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.tibco.com/services/support/advisories (string)

}

1 : { »

source : security@tibco.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.tibco.com/services/support/advisories (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35495 (string)

}

]

sourceIdentifier : security@tibco.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object