CVE-2022-22771

Estado: ModificadaAlta (8.8)—

The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system.

Leer descripción completaMostrar menos

Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.45%
Percentil entre todas las CVEs puntuadas: 84
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Tibco — Jasperreports Library Tibco — Jasperreports Server

CWE

CWE-22

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-22771",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@tibco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@tibco.com",
      "affectedData": [
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Library",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Library for ActiveMatrix BPM",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            },
            {
              "status": "affected",
              "version": "7.9.1"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server for AWS Marketplace",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            },
            {
              "status": "affected",
              "version": "7.9.1"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.0"
            },
            {
              "status": "affected",
              "version": "7.9.1"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server for Microsoft Azure",
          "versions": [
            {
              "status": "affected",
              "version": "7.9.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-15T17:15:09.137",
  "references": [
    {
      "url": "https://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "https://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2022/03/tibco-security-advisory-march-15-2022-tibco-jasperreports-library-2022-22771",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1."
    },
    {
      "lang": "es",
      "value": "El componente Server de TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, y TIBCO JasperReports Server for Microsoft Azure contiene una vulnerabilidad de salto de directorio que teóricamente puede permitir a usuarios del servidor web acceder al contenido del sistema anfitrión. Las versiones afectadas son TIBCO JasperReports Library de TIBCO Software Inc.: versión 7.9.0, TIBCO JasperReports Library para ActiveMatrix BPM: versión 7.9.0, TIBCO JasperReports Server: versiones 7.9.0 y 7.9. 1, TIBCO JasperReports Server para AWS Marketplace: versiones 7.9.0 y 7.9.1, TIBCO JasperReports Server para ActiveMatrix BPM: versiones 7.9.0 y 7.9.1, y TIBCO JasperReports Server para Microsoft Azure: versión 7.9.1"
    }
  ],
  "lastModified": "2026-06-17T04:29:00.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "070D8E68-70C7-473B-BFD4-7AC9BB2B3DB8"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91F0A0AF-D4AA-4748-8417-94D4BFA554BD"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C68AA2D6-C235-48FF-9266-FEFCFDAABC44"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A91FF4F3-C80F-4EFE-A88E-E3D02C068A7D"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A68573E-34FA-494A-830E-95C4FC94B8E9"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D78581FD-D589-4E9D-BA0A-C40FACF292DA"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "461CA1B5-776A-4A0B-9740-1A53D57B8ACA"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE3CE50B-2372-4816-886C-DFD102BF9E6F"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10ABB097-92B6-4B11-ABE8-AA29B85B2680"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:*",
              "vulnerable": true,
              "matchCriteriaId": "072276FC-1901-4DCC-B7CB-4550137E6F97"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@tibco.com"
}