Information disclosure in Tibco Jasperreports Library Community Edition
CVE-2017-5529
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
Vulnerability class: Information Disclosure
EPSS: 0.013 (68.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N.
Affected products
- Tibco Jasperreports_library_community_edition
- Tibco Jasperreports_library_for_activematrix_bpm
- Tibco Jasperreports_professional — versions 6.3.0
- Tibco Jasperreports_server — versions 6.2.0, 6.2.1, 6.3.0
- Tibco Jasperreports_server_community_edition
- Tibco Jasperreports_server_for_activematrix_bpm
- Tibco Jaspersoft_for_aws_with_multi-tenancy
- Tibco Jaspersoft_reporting_and_analytics_for_aws
- Tibco Jaspersoft_studio_for_activematrix_bpm
- Tibco Software Inc. Jasperreports Library Community Edition — versions 6.4.0
Weakness classification (CWE)
References
- security@tibco.com (x_refsource_CONFIRM)
- security@tibco.com (x_refsource_CONFIRM, Vendor Advisory)
- security@tibco.com (x_refsource_CONFIRM)
- security@tibco.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-5529?
- CVE-2017-5529 is a medium-severity vulnerability in Tibco Jasperreports Library Community Edition, classified under Information Disclosure. CVSS score: 4.1/10. Published 2017-06-29.
- How severe is CVE-2017-5529?
- Medium severity. CVSS v3 base score is 4.1 out of 10.