PT-2017-16564 · Tibco · Tibco Jasperreports Server Community Edition+4

Published 2017-11-15 · Updated 2019-10-03 · CVE-2017-5533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server version 6.4.0 TIBCO JasperReports Server Community Edition version 6.4.0 TIBCO JasperReports Server for ActiveMatrix BPM version 6.4.0 TIBCO Jaspersoft for AWS with Multi-Tenancy version 6.4.0 TIBCO Jaspersoft Reporting and Analytics for AWS version 6.4.0

Description A vulnerability in the server content cache of the affected software fails to prevent remote access to all the contents of the web application, including key configuration files.

Recommendations For TIBCO JasperReports Server version 6.4.0, update to a version that contains a fix for this issue. For TIBCO JasperReports Server Community Edition version 6.4.0, update to a version that contains a fix for this issue. For TIBCO JasperReports Server for ActiveMatrix BPM version 6.4.0, update to a version that contains a fix for this issue. For TIBCO Jaspersoft for AWS with Multi-Tenancy version 6.4.0, update to a version that contains a fix for this issue. For TIBCO Jaspersoft Reporting and Analytics for AWS version 6.4.0, update to a version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2017-5533

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Tibco Jaspersoft For Aws With Multi-Tenancy

References · 11

• http://tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-server-2017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5533 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5533 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5533 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Note
• https://oracle.com/security-alerts/cpuapr2020.html · Note
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Note
• http://securityfocus.com/bid/101878 · Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Note