PT-2017-16559 · Tibco · Tibco Jasperreports Server Community Edition+4
Publicado
2017-06-29
·
Atualizado
2021-09-09
·
CVE-2017-5528
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0
TIBCO JasperReports Server Community Edition versions 6.3.0 and below
TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below
TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.2.0 and below
TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.2.0 and below
Description
The issue allows authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks, which may lead to the disclosure of sensitive information.
Recommendations
For TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0, update to a version above 6.3.0 to resolve the issue.
For TIBCO JasperReports Server Community Edition versions 6.3.0 and below, update to a version above 6.3.0 to resolve the issue.
For TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
For TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
For TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Tibco Jasperreports Server
Tibco Jasperreports Server Community Edition
Tibco Jasperreports Server For Activematrix Bpm
Tibco Jaspersoft Reporting/Analytics For Aws
Tibco Jaspersoft For Aws With Multi-Tenancy