CVE-2017-14941: Infoleak
Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14941?
CVE-2017-14941 is considered a medium severity vulnerability due to its potential to expose sensitive credentials.
How do I fix CVE-2017-14941?
To fix CVE-2017-14941, upgrade to a version of JasperReports that does not contain this vulnerability.
Who is affected by CVE-2017-14941?
CVE-2017-14941 affects users of JasperReports version 4.7.0 who have permission to edit Data Source connectors.
What is the nature of the vulnerability in CVE-2017-14941?
CVE-2017-14941 is a saved credential disclosure vulnerability that allows authenticated users to access stored Data Source passwords.
Can CVE-2017-14941 be exploited remotely?
Yes, CVE-2017-14941 can be exploited by remote authenticated users who can access the vulnerable application.