SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2020-9409

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an…

CRITICAL 9.8EPSS 3.42%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.42% probability · 88th percentile
CISA KEV
Not listed
Weakness
CWE-276
Affected
tibco/jasperreports server · oracle/retail order broker
Source
security@tibco.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.