CNVD-2018-15506
Vulnerability from cnvd - Published: 2018-08-16
VLAI Severity ?
Title
多款TIBCO产品存在多个HTML注入漏洞
Description
TIBCO Jaspersoft Studio是一款报表工具，是美国TIBCO软件公司的产品。
多款TIBCO产品存在多个HTML注入漏洞，该漏洞源于未充分验证用户输入。攻击者可以在受影响应用程序环境中执行任意HTML和脚本代码，窃取基于cookie认证证书并控制网页向用户呈现的内容。
Severity
低
Patch Name
多款TIBCO产品存在多个HTML注入漏洞的补丁
Patch Description
TIBCO Jaspersoft Studio是一款报表工具，是美国TIBCO软件公司的产品。
多款TIBCO产品存在多个HTML注入漏洞，该漏洞源于未充分验证用户输入。攻击者可以在受影响应用程序环境中执行任意HTML和脚本代码，窃取基于cookie认证证书并控制网页向用户呈现的内容。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532
Reference
http://www.securityfocus.com/bid/101873
https://nvd.nist.gov/vuln/detail/CVE-2017-5532
Impacted products
| Name | ['TIBCO JasperReports Server 6.3.0', 'TIBCO JasperReports Server 6.3.2', 'TIBCO JasperReports Library 6.3.0', 'TIBCO JasperReports Library 6.3.2', 'TIBCO JasperReports Library 6.4.0', 'TIBCO JasperReports Library 6.4.1', 'TIBCO Jaspersoft Studio 6.3.0', 'TIBCO Jaspersoft Studio 6.3.2', 'TIBCO Jaspersoft Studio 6.4.0', 'TIBCO JasperReports Server Community Edition 6.4.0', 'TIBCO JasperReports Server <=6.2.3', 'TIBCO JasperReports Server 6.3.1', 'TIBCO JasperReports Server Community Edition <=6.4.0', 'TIBCO JasperReports Server for ActiveMatrix BPM <=6.4.0', 'TIBCO JasperReports Library <=6.2.3', 'TIBCO JasperReports Library 6.3.1', 'TIBCO JasperReports Library for ActiveMatrix BPM <=6.4.1', 'TIBCO Jaspersoft for AWS with Multi-Tenancy <=6.4.0', 'TIBCO Jaspersoft Reporting and Analytics for AWS <=6.4.0', 'TIBCO Jaspersoft Studio <=6.2.3', 'TIBCO Jaspersoft Studio 6.3.1', 'TIBCO Jaspersoft Studio for ActiveMatrix BPM <=6.4.0'] |
|---|
{
"bids": {
"bid": {
"bidNumber": "101873"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-5532",
"cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5532"
}
},
"description": "TIBCO Jaspersoft Studio\u662f\u4e00\u6b3e\u62a5\u8868\u5de5\u5177\uff0c\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eTIBCO\u4ea7\u54c1\u5b58\u5728\u591a\u4e2aHTML\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610fHTML\u548c\u811a\u672c\u4ee3\u7801\uff0c\u7a83\u53d6\u57fa\u4e8ecookie\u8ba4\u8bc1\u8bc1\u4e66\u5e76\u63a7\u5236\u7f51\u9875\u5411\u7528\u6237\u5448\u73b0\u7684\u5185\u5bb9\u3002",
"discovererName": "TIBCO",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2018-15506",
"openTime": "2018-08-16",
"patchDescription": "TIBCO Jaspersoft Studio\u662f\u4e00\u6b3e\u62a5\u8868\u5de5\u5177\uff0c\u662f\u7f8e\u56fdTIBCO\u8f6f\u4ef6\u516c\u53f8\u7684\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eTIBCO\u4ea7\u54c1\u5b58\u5728\u591a\u4e2aHTML\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5145\u5206\u9a8c\u8bc1\u7528\u6237\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u53d7\u5f71\u54cd\u5e94\u7528\u7a0b\u5e8f\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610fHTML\u548c\u811a\u672c\u4ee3\u7801\uff0c\u7a83\u53d6\u57fa\u4e8ecookie\u8ba4\u8bc1\u8bc1\u4e66\u5e76\u63a7\u5236\u7f51\u9875\u5411\u7528\u6237\u5448\u73b0\u7684\u5185\u5bb9\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "\u591a\u6b3eTIBCO\u4ea7\u54c1\u5b58\u5728\u591a\u4e2aHTML\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"TIBCO JasperReports Server 6.3.0",
"TIBCO JasperReports Server 6.3.2",
"TIBCO JasperReports Library 6.3.0",
"TIBCO JasperReports Library 6.3.2",
"TIBCO JasperReports Library 6.4.0",
"TIBCO JasperReports Library 6.4.1",
"TIBCO Jaspersoft Studio 6.3.0",
"TIBCO Jaspersoft Studio 6.3.2",
"TIBCO Jaspersoft Studio 6.4.0",
"TIBCO JasperReports Server Community Edition 6.4.0",
"TIBCO JasperReports Server \u003c=6.2.3",
"TIBCO JasperReports Server 6.3.1",
"TIBCO JasperReports Server Community Edition \u003c=6.4.0",
"TIBCO JasperReports Server for ActiveMatrix BPM \u003c=6.4.0",
"TIBCO JasperReports Library \u003c=6.2.3",
"TIBCO JasperReports Library 6.3.1",
"TIBCO JasperReports Library for ActiveMatrix BPM \u003c=6.4.1",
"TIBCO Jaspersoft for AWS with Multi-Tenancy \u003c=6.4.0",
"TIBCO Jaspersoft Reporting and Analytics for AWS \u003c=6.4.0",
"TIBCO Jaspersoft Studio \u003c=6.2.3",
"TIBCO Jaspersoft Studio 6.3.1",
"TIBCO Jaspersoft Studio for ActiveMatrix BPM \u003c=6.4.0"
]
},
"referenceLink": "http://www.securityfocus.com/bid/101873\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-5532",
"serverity": "\u4f4e",
"submitTime": "2018-05-29",
"title": "\u591a\u6b3eTIBCO\u4ea7\u54c1\u5b58\u5728\u591a\u4e2aHTML\u6ce8\u5165\u6f0f\u6d1e"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…