TIBCO JasperReports Library Directory Traversal Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: version 7.9.0, TIBCO JasperReports Library for ActiveMatrix BPM: version 7.9.0, TIBCO JasperReports Server: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and 7.9.1, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and 7.9.1, and TIBCO JasperReports Server for Microsoft Azure: version 7.9.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO JasperReports Library | 7.9.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library for ActiveMatrix BPM | 7.9.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server | 7.9.0; 7.9.1 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for AWS Marketplace | 7.9.0; 7.9.1 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for ActiveMatrix BPM | 7.9.0; 7.9.1 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for Microsoft Azure | 7.9.1 | — | No fix listed | CNA |
- TIBCO JasperReports Library VendorTIBCO Affected 7.9.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Library for ActiveMatrix BPM VendorTIBCO Affected 7.9.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server VendorTIBCO Affected 7.9.0; 7.9.1 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for AWS Marketplace VendorTIBCO Affected 7.9.0; 7.9.1 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for ActiveMatrix BPM VendorTIBCO Affected 7.9.0; 7.9.1 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for Microsoft Azure VendorTIBCO Affected 7.9.1 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:* | 7.9.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:* | 7.9.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:* | 7.9.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:* | 7.9.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:* | 7.9.1 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:-:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:7.9.0:*:*:*:*:activematrix_bpm:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:activematrix_bpm:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:aws_marketplace:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:azure:*:* Versions 7.9.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:-:*:* Versions 7.9.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:activematrix_bpm:*:* Versions 7.9.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:aws_marketplace:*:* Versions 7.9.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.9.1:*:*:*:*:azure:*:* Versions 7.9.1 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22771
- 2026-10-03 Alias added: GHSA-g4m4-hxvm-28mq
References
More TIBCO Jasperreports Library vulnerabilities
- TI-2018-13320 TIBCO JasperReports Library Directory Traversal Vulnerability KEVCVSS 3.1MEDIUM 6.5
- TI-2020-07526 Cross-site scripting in TIBCO JasperReports Library CVSS 3.1HIGH 8.8
- TI-2018-03943 TIBCO JasperReports Library Code Sandboxing Problem CVSS 3.0HIGH 8.8
- TI-2017-03547 TIBCO JasperReports persistent cross site scripting CVSS 3.0MEDIUM 5.4
Sources
- CVE-2022-22771 · CVE Program
- CVE-2022-22771 · NVD
- FIRST EPSS
- GHSA-g4m4-hxvm-28mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences