CVE-2020-9409: oracle retail_order_broker Incorrect Default Permissions
Vulnerability summary
CVE-2020-9409 is a high (CVSS 10.0) Incorrect Default Permissions vulnerability in oracle retail_order_broker. EPSS estimates a 3.50% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities.
Timeline
- 20-05-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.50%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
+0.09 pp
From 3.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Tibco software inc.3 products
- tibco jasperreports server≥ unspecified, ≤ 7.1.1
- tibco jasperreports server for activematrix bpm≥ unspecified, ≤ 7.1.1
- tibco jasperreports server for aws marketplace≥ unspecified, ≤ 7.1.1
Oracle1 product
- retail_order_broker15.0 | 16.0
Tibco1 product
- jasperreports_server≤ 7.1.1
3 vendors · 5 products