CVE-2017-5528: CSRF
First published: Thu Jun 29 2017(Updated: )
Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).
Credit: security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TIBCO JasperReports Server | <=6.1.1 | |
| TIBCO JasperReports Server | =6.2.0 | |
| TIBCO JasperReports Server | =6.2.1 | |
| TIBCO JasperReports Server | =6.3.0 | |
| TIBCO JasperReports Server | <=6.3.0 | |
| TIBCO JasperReports Server | <=6.2.0 | |
| TIBCO Jaspersoft AWS with Multi-Tenancy | <=6.2.0 | |
| TIBCO Jaspersoft Reporting and Analytics AWS | <=6.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-5528?
CVE-2017-5528 has a moderate severity level due to its potential for cross-site scripting and cross-site request forgery attacks.
How do I fix CVE-2017-5528?
To fix CVE-2017-5528, upgrade to TIBCO JasperReports Server version 6.4.0 or later, which addresses the identified vulnerabilities.
Which versions of TIBCO JasperReports Server are affected by CVE-2017-5528?
CVE-2017-5528 affects TIBCO JasperReports Server versions 6.1.1 and earlier, as well as specific versions like 6.2.0, 6.2.1, and 6.3.0.
What types of attacks can CVE-2017-5528 enable?
CVE-2017-5528 can enable cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.
What is the impact of CVE-2017-5528 on sensitive information?
The impact of CVE-2017-5528 includes the theoretical disclosure of sensitive information due to the vulnerabilities present.
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/description
- vendor/tibco
- canonical/tibco jasperreports server
- version/tibco jasperreports server/6.1.1
- version/tibco jasperreports server/6.2.0
- version/tibco jasperreports server/6.2.1
- version/tibco jasperreports server/6.3.0
- canonical/tibco jaspersoft aws with multi-tenancy
- version/tibco jaspersoft aws with multi-tenancy/6.2.0
- canonical/tibco jaspersoft reporting and analytics aws
- version/tibco jaspersoft reporting and analytics aws/6.2.0