CVE-2017-5529
Description
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| tibco | jasperreports_library_community_edition | {"endIncluding":"6.4.0"} | |
| tibco | jasperreports_library_for_activematrix_bpm | {"endIncluding":"6.2.0"} | |
| tibco | jasperreports_professional | {"endIncluding":"6.2.1"} | |
| tibco | jasperreports_professional | 6.3.0 | |
| tibco | jasperreports_server | {"endIncluding":"6.1.1"} | |
| tibco | jasperreports_server | 6.2.0 | |
| tibco | jasperreports_server | 6.2.1 | |
| tibco | jasperreports_server | 6.3.0 | |
| tibco | jasperreports_server_community_edition | {"endIncluding":"6.3.0"} | |
| tibco | jasperreports_server_for_activematrix_bpm | {"endIncluding":"6.2.0"} | |
| tibco | jaspersoft_for_aws_with_multi-tenancy | {"endIncluding":"6.3.0"} | |
| tibco | jaspersoft_reporting_and_analytics_for_aws | {"endIncluding":"6.3.0"} | |
| tibco | jaspersoft_studio_for_activematrix_bpm | {"endIncluding":"6.2.0"} | |
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0
CWEs
CWE-200
💬 Discuss CVE-2017-5529 on VIR Community →
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.