CSRF in Jasperforge Jasperreports Server Community Project
CVE-2011-1911
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.015 (71.5th percentile) — read the EPSS interpretation.
Affected products
- Jasperforge Jasperreports_server_community_project — versions 3.7.0, 3.7.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (x_refsource_MISC)
- cret@cert.org (x_refsource_MISC)
- cret@cert.org (vdb-entry, x_refsource_XF)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cret@cert.org (x_refsource_CONFIRM, US Government Resource)
- cret@cert.org (vdb-entry, x_refsource_BID)