CVE-2022-22773
TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability
- Published
- Updated
- Reserved
- Assigned by
- tibco
Description
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.
Timeline
ID reserved
By tibco
- 4 months later
· 4 months later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| tibcoCNA (assigner) | 3.1 | High7.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.52% · top 55% of all CVEs (8 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.
Weakness
- In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
- CWE-79 (opens in a new tab)All about CWE-79 and its CVEs
Affected products
TIBCO Software Inc. · TIBCO JasperReports Server
- affected unspecified – ≤ 8.0.1
TIBCO Software Inc. · TIBCO JasperReports Server - Community Edition
- affected unspecified – ≤ 8.0.1
TIBCO Software Inc. · TIBCO JasperReports Server - Developer Edition
- affected unspecified – ≤ 8.0.0
TIBCO Software Inc. · TIBCO JasperReports Server for AWS Marketplace
- affected unspecified – ≤ 8.0.1
TIBCO Software Inc. · TIBCO JasperReports Server for ActiveMatrix BPM
- affected unspecified – ≤ 7.9.2
TIBCO Software Inc. · TIBCO JasperReports Server for Microsoft Azure
- affected unspecified – ≤ 8.0.1
What to do
Solution: TIBCO has released updated versions of the affected components which address these issues. TIBCO JasperReports Server versions 8.0.1 and below: update to version 8.0.2 or later TIBCO JasperReports Server - Community Edition versions 8.0.1 and below: update to version 8.0.2 or later TIBCO JasperReports Server - Developer Edition versions 8.0.0 and below: update to version 8.0.2 or later TIBCO JasperReports Server for AWS Marketplace versions 8.0.1 and below: update to version 8.0.2 or later TIBCO JasperReports Server for ActiveMatrix BPM versions 7.9.2 and below: This product is deprecated and should be uninstalled TIBCO JasperReports Server for Microsoft Azure versions 8.0.1 and below: update to version 8.0.2 or later
References (2)
- https://www.tibco.com/services/support/advisories (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.tibco.com/support/advisories/2022/05/tibco-security-advisory-may-17-2022-tibco-jasperreports-server-cve-2022-22773 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2022-22773)Record last updated .