CVE-2022-41562

What it actually does

The HTML escaping component fails to properly sanitize input, allowing a privileged attacker to inject and execute arbitrary JavaScript in the context of other users' sessions via network-accessible administrative interfaces.

Why it matters to the business

Successful exploitation can lead to full administrative takeover of reporting servers, data exfiltration, or unauthorized changes to sensitive business reports and dashboards, increasing operational risk for organizations relying on these servers for analytics.

How an attack unfolds

An authenticated administrative user crafts a malicious payload that bypasses HTML escaping and stores it in a shared report or dashboard; when another user with sufficient privileges views the content, the script executes in their browser, enabling session hijacking or further actions.

How to fix it

Upgrade all instances of TIBCO JasperReports Server, Community Edition, Developer Edition, and marketplace/Azure variants to the latest vendor-released versions that address the escaping flaw; apply any available security patches immediately and restrict administrative interface exposure.

How to confirm the fix worked

Review release notes for versions after 8.1.0 to confirm the HTML escaping fix is present; test by attempting known XSS payloads in administrative views and verify they are neutralized; scan configurations for proper input sanitization enforcement.

Typical attack path

1. Attacker obtains administrative credentials or network access to the JasperReports Server.
2. Attacker injects unsanitized HTML/JS payload into a report definition, parameter, or UI element.
3. Payload is stored and served to other authenticated users.
4. Victim user interacts with the affected page, triggering script execution.
5. Attacker leverages the resulting browser context for data theft or privilege escalation.

How to detect it

Examine web server and application logs for requests containing script tags, event handlers, or encoded JavaScript payloads submitted to administrative endpoints; monitor for unexpected changes to report templates or dashboard definitions by privileged accounts.

• <script>
• onerror=
• javascript:
• data:text/html

What your security team should do

• Prioritize patching or upgrading all affected JasperReports Server deployments within the next 30 days given the administrative access requirement.
• Limit network exposure of administrative interfaces to trusted subnets only.
• Implement web application firewall rules to block common XSS patterns targeting reporting endpoints.
• Conduct regular audits of report definitions and user-generated content for suspicious scripts.