Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-5529

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).

Published

2017-06-29T14:29:00.210

Last Modified

2025-04-20T01:37:25.860

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 4.1 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	tibco	jasperreports_library_community_edition	≤ 6.4.0	Yes
Application	tibco	jasperreports_library_for_activematrix_bpm	≤ 6.2.0	Yes
Application	tibco	jasperreports_professional	≤ 6.2.1	Yes
Application	tibco	jasperreports_professional	6.3.0	Yes
Application	tibco	jasperreports_server	≤ 6.1.1	Yes
Application	tibco	jasperreports_server	6.2.0	Yes
Application	tibco	jasperreports_server	6.2.1	Yes
Application	tibco	jasperreports_server	6.3.0	Yes
Application	tibco	jasperreports_server_community_edition	≤ 6.3.0	Yes
Application	tibco	jasperreports_server_for_activematrix_bpm	≤ 6.2.0	Yes
Application	tibco	jaspersoft_for_aws_with_multi-tenancy	≤ 6.3.0	Yes
Application	tibco	jaspersoft_reporting_and_analytics_for_aws	≤ 6.3.0	Yes
Application	tibco	jaspersoft_studio_for_activematrix_bpm	≤ 6.2.0	Yes

References

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html ([email protected])
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html ([email protected])
https://www.oracle.com/security-alerts/cpuapr2020.html ([email protected])
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0 Vendor Advisory ([email protected])
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html (af854a3a-2127-422b-91ae-364da2661108)
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpuapr2020.html (af854a3a-2127-422b-91ae-364da2661108)
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)