What is CVE-2021-35496?

CVE-2021-35496 is a high-severity vulnerability in Tibco Jasperreports Server, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2021-10-12.

How severe is CVE-2021-35496?

High severity. CVSS v3 base score is 7.5 out of 10.

XXE in Tibco Jasperreports Server

CVE-2021-35496

The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to interfere with XML processing in the affected component. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.2.1 and below, TIBCO JasperReports Server: versions 7.5.0 and 7.5.1, TIBCO JasperReports Server: version 7.8.0, TIBCO JasperReports Server: version 7.9.0, TIBCO JasperReports Server - Community Edition: versions 7.8.0 and below, TIBCO JasperReports Server - Developer Edition: versions 7.9.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.9.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.0 and below, and TIBCO JasperReports Server for Microsoft Azure: version 7.8.0.

Vulnerability class: XXE (XML External Entity)

Published 2021-10-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (48.7th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Tibco Jasperreports Server — versions 7.5.0, 7.5.1, 7.8.0
Tibco Software Inc. Jasperreports Server — versions unspecified, 7.5.0, 7.5.1
Tibco Software Inc. Jasperreports Server - Community Edition — versions unspecified
Tibco Software Inc. Jasperreports Server - Developer Edition — versions unspecified
Tibco Software Inc. Jasperreports Server For Activematrix Bpm — versions unspecified
Tibco Software Inc. Jasperreports Server For AWS Marketplace — versions unspecified
Tibco Software Inc. Jasperreports Server For Microsoft Azure — versions 7.8.0

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

www.tibco.com/services/support/advisories (Vendor Advisory)

Frequently asked questions

What is CVE-2021-35496?: CVE-2021-35496 is a high-severity vulnerability in Tibco Jasperreports Server, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2021-10-12.
How severe is CVE-2021-35496?: High severity. CVSS v3 base score is 7.5 out of 10.