CSRF in Tibco Jasperreports Server
CVE-2017-5528
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Tibco Jasperreports_server — versions 6.2.0, 6.2.1, 6.3.0
- Tibco Jaspersoft
- Tibco Jaspersoft_reporting_and_analytics
- Tibco Software Inc. Jasperreports Server — versions unspecified, 6.3.0, 6.2.1
- Tibco Software Inc. Jasperreports Server Community Edition — versions unspecified
- Tibco Software Inc. Jasperreports Server For Activematrix Bpm — versions unspecified
- Tibco Software Inc. Jaspersoft For Aws With Multi-tenancy — versions unspecified
- Tibco Software Inc. Jaspersoft Reporting And Analytics For Aws — versions unspecified
Weakness classification (CWE)
References
- security@tibco.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-5528?
- CVE-2017-5528 is a high-severity vulnerability in Tibco Jasperreports Server, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-06-29.
- How severe is CVE-2017-5528?
- High severity. CVSS v3 base score is 8.8 out of 10.