PT-2017-16560 · Tibco · Tibco Jasperreports Server Community Edition+8

Publicado 2017-06-29 · Atualizado 2018-10-17 · CVE-2017-5529

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

A:N/AC:L/AV:N/C:L/I:N/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Library Community Edition versions 6.4.0 and below TIBCO JasperReports Library for ActiveMatrix BPM versions 6.2.0 and below TIBCO JasperReports Professional versions 6.2.1 and below, 6.3.0 TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0 TIBCO JasperReports Server Community Edition versions 6.3.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.3.0 and below TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.3.0 and below TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.2.0 and below

Description The JasperReports library components contain an information disclosure issue, which could theoretically lead to the disclosure of any accessible information from the host file system.

Recommendations For TIBCO JasperReports Library Community Edition versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO JasperReports Library for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0. For TIBCO JasperReports Professional versions 6.2.1 and below, 6.3.0, update to a version above 6.3.0. For TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0, update to a version above 6.3.0. For TIBCO JasperReports Server Community Edition versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5529

Produtos afetados

Jasperreports Library Community Edition

Tibco Jasperreports Library For Activematrix Bpm

Jasperreports Professional

Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Jaspersoft Studio For Activematrix Bpm

Tibco Jaspersoft For Aws With Multi-Tenancy

Referências · 9

• https://osv.dev/vulnerability/CVE-2017-5529 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuapr2020.html · Nota
• https://ubuntu.com/security/CVE-2017-5529 · Aviso do Fabricante
• https://tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0 · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5529 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-5529 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-5529 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Nota