Medium severity · published Jun 29, 2017
CVE-2017-5529
JasperReports library components contain an information disclosure vulnerability
6.5
CVSS
1.3%
EPSS
No
On KEV
Description
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JL
Jasperreports Library Community Edition · Tibco
through 6.4.0 · source: NVD
JL
Jasperreports Library For Activematrix Bpm · Tibco
through 6.2.0 · source: NVD
JP
Jasperreports Professional · Tibco
through 6.2.1; 6.3.0 · source: NVD
JS
Jasperreports Server · Tibco
through 6.1.1; 6.2.0; 6.2.1; 6.3.0 · source: NVD
JS
Jasperreports Server Community Edition · Tibco
through 6.3.0 · source: NVD
JS
Jasperreports Server For Activematrix Bpm · Tibco
through 6.2.0 · source: NVD
JF
Jaspersoft For Aws With Multi-tenancy · Tibco
through 6.3.0 · source: NVD
JR
Jaspersoft Reporting And Analytics For Aws · Tibco
through 6.3.0 · source: NVD
JS
Jaspersoft Studio For Activematrix Bpm · Tibco
through 6.2.0 · source: NVD
Affected product
JL
Jasperreports Library Community Edition
Tibco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5529
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
www.oracle.com
https://www.oracle.com/security-alerts/cpuapr2020.html
Vendor Advisory
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0