PT-2017-16563 · Tibco · Tibco Jasperreports Server Community Edition+8

Published 2017-11-15 · Updated 2019-10-09 · CVE-2017-5532

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0 TIBCO JasperReports Server Community Edition versions 6.4.0 and below TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.0 and below TIBCO JasperReports Library versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1 TIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.1 and below TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.4.0 and below TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.4.0 and below TIBCO Jaspersoft Studio versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0 TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.4.0 and below

Description A vulnerability in the report renderer component may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks.

Recommendations For TIBCO JasperReports Server versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, update to a version above 6.4.0. For TIBCO JasperReports Server Community Edition versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO JasperReports Library versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, update to a version above 6.4.1. For TIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.1 and below, update to a version above 6.4.1. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.4.0 and below, update to a version above 6.4.0. For TIBCO Jaspersoft Studio versions 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, update to a version above 6.4.0. For TIBCO Jaspersoft Studio for ActiveMatrix BPM versions 6.4.0 and below, update to a version above 6.4.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-5532

Affected Products

Tibco Jasperreports Library

Tibco Jasperreports Library For Activematrix Bpm

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Tibco Jaspersoft Studio

Jaspersoft Studio For Activematrix Bpm

Tibco Jaspersoft For Aws With Multi-Tenancy

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-5532 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5532 · Vendor Advisory
• https://tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5532 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5532 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5532 · Vendor Advisory
• http://securityfocus.com/bid/101873 · Note