CVE-2021-35494

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Rest API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contain a race condition that allows a low privileged authenticated attacker via the REST API to obtain read access to temporary objects created by other users on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
TIBCO Software Inc.TIBCO JasperReports Server>= unspecified, <= 7.2.1
TIBCO Software Inc.TIBCO JasperReports Server7.5.0; 7.5.1
TIBCO Software Inc.TIBCO JasperReports Server7.8.0
TIBCO Software Inc.TIBCO JasperReports Server7.9.0
TIBCO Software Inc.TIBCO JasperReports Server - Community Edition>= unspecified, <= 7.8.0
TIBCO Software Inc.TIBCO JasperReports Server - Developer Edition>= unspecified, <= 7.9.0
TIBCO Software Inc.TIBCO JasperReports Server for AWS Marketplace>= unspecified, <= 7.9.0
TIBCO Software Inc.TIBCO JasperReports Server for ActiveMatrix BPM>= unspecified, <= 7.9.0
TIBCO Software Inc.TIBCO JasperReports Server for Microsoft Azure7.8.0

References

Timeline

Published
Oct 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-354958.8The Scheduler Connection component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports ServCVE-2021-354967.5The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, CVE-2021-354977.5The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community ECVE-2021-354989.8The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX, TIBCO EBX, TIBCO EBX, and TIBCO Product and Service Catalog powered bCVE-2021-354995.4The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilitCVE-2021-35507.8A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation.CVE-2021-355005.5The Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization, TIBCO Data Virtualization, TIBCO Data VirtualizCVE-2021-355015.4PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the cCVE-2021-355029.8app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-tempCVE-2021-355036.1Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.CVE-2021-355047.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.CVE-2021-355057.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
CVE-2021-35494: Medium severity, CVSS 5.3 | Vulnix