PT-2017-16560 · Tibco · Tibco Jasperreports Server Community Edition+8

Published 2017-06-29 · Updated 2018-10-17 · CVE-2017-5529

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

A:N/AC:L/AV:N/C:L/I:N/PR:L/S:C/UI:R

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Library Community Edition versions 6.4.0 and below TIBCO JasperReports Library for ActiveMatrix BPM versions 6.2.0 and below TIBCO JasperReports Professional versions 6.2.1 and below, 6.3.0 TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0 TIBCO JasperReports Server Community Edition versions 6.3.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.3.0 and below TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.3.0 and below TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.2.0 and below

Description The JasperReports library components contain an information disclosure issue, which could theoretically lead to the disclosure of any accessible information from the host file system.

Recommendations For TIBCO JasperReports Library Community Edition versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO JasperReports Library for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0. For TIBCO JasperReports Professional versions 6.2.1 and below, 6.3.0, update to a version above 6.3.0. For TIBCO JasperReports Server versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0, update to a version above 6.3.0. For TIBCO JasperReports Server Community Edition versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO JasperReports Server for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.3.0 and below, update to a version above 6.3.0. For TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.2.0 and below, update to a version above 6.2.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5529

Affected Products

Jasperreports Library Community Edition

Tibco Jasperreports Library For Activematrix Bpm

Jasperreports Professional

Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Jaspersoft Studio For Activematrix Bpm

Tibco Jaspersoft For Aws With Multi-Tenancy

References · 9

• https://osv.dev/vulnerability/CVE-2017-5529 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5529 · Vendor Advisory
• https://tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5529 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5529 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5529 · Security Note
• https://oracle.com/security-alerts/cpuapr2020.html · Note
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Note