The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.
References
| Link | Resource |
|---|---|
| https://www.tibco.com/services/support/advisories | Vendor Advisory |
| https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Oct 2021, 12:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://www.tibco.com/services/support/advisories - Vendor Advisory | |
| References | (CONFIRM) https://www.tibco.com/support/advisories/2021/10/tibco-security-advisory-october-12-2021-tibco-jasperreports-server-2021-35494 - Vendor Advisory | |
| CWE | CWE-362 | |
| CPE | cpe:2.3:a:tibco:jasperreports_server:7.8.0:*:*:*:*:-:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:-:*:* cpe:2.3:a:tibco:jasperreports_server:7.5.1:*:*:*:*:-:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:microsoft_azure:*:* cpe:2.3:a:tibco:jasperreports_server:7.5.0:*:*:*:*:-:*:* cpe:2.3:a:tibco:jasperreports_server:7.9.0:*:*:*:*:-:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:aws_marketplace:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:developer:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.3 |
12 Oct 2021, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-10-12 18:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-35494
Mitre link : CVE-2021-35494
CVE.ORG link : CVE-2021-35494
JSON object : View
Products Affected
tibco
- jasperreports_server
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')