Critical severity · published Nov 15, 2017
CVE-2017-5533
A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO…
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jasperreports Server · Tibco
6.4.0; 6.4.0; 6.4.0 · source: NVD
JA
Jaspersoft · Tibco
6.4.0 · source: NVD
JR
Jaspersoft Reporting And Analytics · Tibco
6.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5533
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Third Party Advisory
http://www.securityfocus.com/bid/101878
Issue Tracking
http://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-server-2017
www.oracle.com
https://www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
More from Jasperreports Server
8.8
CVE-2018-5430
TIBCO JasperReports Server Information Disclosure Vulnerability
6.5
CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
9.8
CVE-2020-9409
The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for…
9.8
CVE-2018-18815
TIBCO JasperReports Server User Information Disclosure
8.8
CVE-2022-22771
The Server component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server…