High severity · published Jun 29, 2017
CVE-2017-5528
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF)…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jasperreports Server · Tibco
through 6.1.1; 6.2.0; 6.2.1; 6.3.0; through 6.3.0; through 6.2.0 · source: NVD
JA
Jaspersoft · Tibco
through 6.2.0 · source: NVD
JR
Jaspersoft Reporting And Analytics · Tibco
through 6.2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5528
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5528
Vendor Advisory
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017
More from Jasperreports Server
8.8
CVE-2018-5430
TIBCO JasperReports Server Information Disclosure Vulnerability
6.5
CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
9.8
CVE-2020-9409
The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for…
9.8
CVE-2018-18815
TIBCO JasperReports Server User Information Disclosure
9.8
CVE-2017-5533
A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO…