PT-2017-16559 · Tibco · Tibco Jasperreports Server Community Edition+4
Published
2017-06-29
·
Updated
2021-09-09
·
CVE-2017-5528
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0
TIBCO JasperReports Server Community Edition versions 6.3.0 and below
TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below
TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.2.0 and below
TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.2.0 and below
Description
The issue allows authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks, which may lead to the disclosure of sensitive information.
Recommendations
For TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0, update to a version above 6.3.0 to resolve the issue.
For TIBCO JasperReports Server Community Edition versions 6.3.0 and below, update to a version above 6.3.0 to resolve the issue.
For TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
For TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
For TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.2.0 and below, update to a version above 6.2.0 to resolve the issue.
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tibco Jasperreports Server
Tibco Jasperreports Server Community Edition
Tibco Jasperreports Server For Activematrix Bpm
Tibco Jaspersoft Reporting/Analytics For Aws
Tibco Jaspersoft For Aws With Multi-Tenancy