CVE-2017-5528: TIBCO JasperReports Server cross-site vulnerabilities
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5528?
CVE-2017-5528 has a moderate severity level due to its potential for cross-site scripting and cross-site request forgery attacks.
How do I fix CVE-2017-5528?
To fix CVE-2017-5528, upgrade to TIBCO JasperReports Server version 6.4.0 or later, which addresses the identified vulnerabilities.
Which versions of TIBCO JasperReports Server are affected by CVE-2017-5528?
CVE-2017-5528 affects TIBCO JasperReports Server versions 6.1.1 and earlier, as well as specific versions like 6.2.0, 6.2.1, and 6.3.0.
What types of attacks can CVE-2017-5528 enable?
CVE-2017-5528 can enable cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.
What is the impact of CVE-2017-5528 on sensitive information?
The impact of CVE-2017-5528 includes the theoretical disclosure of sensitive information due to the vulnerabilities present.