Medium severity · published Nov 15, 2017
CVE-2017-5532
A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM,…
5.4
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JL
Jasperreports Library · Tibco
through 6.2.3; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1; +1 more · source: NVD
JS
Jasperreports Server · Tibco
through 6.2.3; 6.3.0; 6.3.1; 6.3.2; 6.4.0; through 6.4.0; +1 more · source: NVD
JA
Jaspersoft · Tibco
through 6.4.0 · source: NVD
JR
Jaspersoft Reporting And Analytics · Tibco
through 6.4.0 · source: NVD
JS
Jaspersoft Studio · Tibco
through 6.2.3; 6.3.0; 6.3.1; 6.3.2; 6.4.0; through 6.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5532
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5532
Issue Tracking
http://www.securityfocus.com/bid/101873
Issue Tracking
https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532
More from Jasperreports Library
6.5
CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
8.8
CVE-2022-22771
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server…
8.8
CVE-2020-9410
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO…
8.8
CVE-2018-5429
A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for…