Lucene search

[email protected]CVE-2017-5528

HistoryJun 29, 2017 - 2:29 p.m.

CVE-2017-5528

2017-06-2914:29:00

CWE-352

[email protected]

web.nvd.nist.gov

cve-2017-5528

jasperreports server

xss

csrf

tibco

security vulnerability

nvd

cve

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.5%

JSON

Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).

Affected configurations

NVD

Node

tibcojasperreports_serverRange≤6.1.1

tibcojasperreports_serverMatch6.2.0--

tibcojasperreports_serverMatch6.2.1--

tibcojasperreports_serverMatch6.3.0--

Node

tibcojasperreports_serverRange≤6.3.0community

Node

tibcojasperreports_serverRange≤6.2.0activematrix_bpm

Node

tibcojaspersoftRange≤6.2.0aws_with_multi-tenancy

Node

tibcojaspersoft_reporting_and_analyticsRange≤6.2.0aws

CPENameOperatorVersion
tibco:jasperreports_servertibco jasperreports serverle6.1.1
tibco:jasperreports_servertibco jasperreports servereq6.2.0
tibco:jasperreports_servertibco jasperreports servereq6.2.1
tibco:jasperreports_servertibco jasperreports servereq6.3.0

CPE	Name	Operator	Version
tibco:jasperreports_server	tibco jasperreports server	le	6.1.1
tibco:jasperreports_server	tibco jasperreports server	eq	6.2.0
tibco:jasperreports_server	tibco jasperreports server	eq	6.2.1
tibco:jasperreports_server	tibco jasperreports server	eq	6.3.0

CNA Affected

[
  {
    "product": "TIBCO JasperReports Server",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.1.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.2.0"
      },
      {
        "status": "affected",
        "version": "6.2.1"
      },
      {
        "status": "affected",
        "version": "6.3.0"
      }
    ]
  },
  {
    "product": "TIBCO JasperReports Server Community Edition",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.2.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TIBCO Jaspersoft for AWS with Multi-Tenancy",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "TIBCO Jaspersoft Reporting and Analytics for AWS",
    "vendor": "TIBCO Software Inc.",
    "versions": [
      {
        "lessThanOrEqual": "6.3.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]