CVE-2022-41563

What it actually does

Stored XSS in the Dashboard component permits a low-privileged attacker to inject persistent malicious scripts that execute in the browsers of other users who view the affected dashboard.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive report data, or deliver phishing payloads inside the organization, eroding trust in internal reporting systems and potentially leading to broader account compromise.

How an attack unfolds

A low-privileged user with network access crafts a stored XSS payload inside the Dashboard component; when another user interacts with the dashboard the script runs in their session, performing actions or harvesting data under the victim's privileges.

How to fix it

Upgrade TIBCO JasperReports Server, Developer Edition, AWS Marketplace, and Azure editions to versions beyond the affected releases (8.0.2 and 8.1.0) once vendor patches are released; in the interim restrict dashboard editing privileges and enforce strict content-security policies.

How to confirm the fix worked

After upgrade, retest the dashboard component by submitting known XSS vectors and confirm that scripts are sanitized on storage and properly encoded on render; review audit logs for any residual malicious payloads.

Typical attack path

1. Attacker authenticates with a low-privileged account that has dashboard editing rights
2. Attacker inserts a malicious script payload into a dashboard component field
3. Payload is stored server-side and served to other users
4. Victim user views the dashboard, triggering script execution in their browser context

How to detect it

Search JasperReports Server access and audit logs for dashboard save events containing HTML or script tags; inspect rendered dashboard HTML for unexpected script or event-handler attributes; correlate with user activity showing unusual dashboard modifications followed by victim sessions.

What your security team should do

• Apply vendor updates for JasperReports Server as soon as they become available
• Reduce the number of users granted dashboard edit permissions
• Enable web-application firewall rules that block common XSS patterns targeting reporting dashboards
• Monitor EPSS trend and reassess risk if exploit maturity increases