PT-2025-54691 · Maven · Net.Sf.Jasperreports:Jasperreports

Publicado 2025-09-16 · Atualizado 2025-09-16

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

GHSA-7C3F-CG9X-F3GR

Produtos afetados

Net.Sf.Jasperreports:Jasperreports

Referências · 8

• https://github.com/Jaspersoft/jasperreports/commit/3541a3e2b1ad8b78388ac505091da75cb652a647 · Nota
• https://github.com/Jaspersoft/jasperreports/commit/827c2f27c4ca8e2c5b3142d76df9c1c8575f3569 · Nota
• https://github.com/Jaspersoft/jasperreports/issues/542 · Nota
• https://github.com/Jaspersoft/jasperreports · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-10492 · Nota de Segurança
• https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition · Nota
• https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6 · Nota
• https://osv.dev/vulnerability/GHSA-7c3f-cg9x-f3gr · Aviso do Fabricante