fkie_nvd - fkie_cve-2017-5532

FKIE_CVE-2017-5532

Vulnerability from fkie_nvd - Published: 2017-11-15 21:29 - Updated: 2025-04-20 01:37

Severity ?

5.4 (Medium) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.

References

URL	Tags
security@tibco.com	http://www.securityfocus.com/bid/101873	Issue Tracking, Third Party Advisory, VDB Entry
security@tibco.com	https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532	Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/101873	Issue Tracking, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532	Issue Tracking, Vendor Advisory

Impacted products

Vendor	Product	Version
tibco	jasperreports_server	*
tibco	jasperreports_server	6.3.0
tibco	jasperreports_server	6.3.1
tibco	jasperreports_server	6.3.2
tibco	jasperreports_server	6.4.0
tibco	jasperreports_server	*
tibco	jasperreports_server	*
tibco	jasperreports_library	*
tibco	jasperreports_library	6.3.0
tibco	jasperreports_library	6.3.1
tibco	jasperreports_library	6.3.2
tibco	jasperreports_library	6.4.0
tibco	jasperreports_library	6.4.1
tibco	jasperreports_library	*
tibco	jaspersoft	*
tibco	jaspersoft_reporting_and_analytics	*
tibco	jaspersoft_studio	*
tibco	jaspersoft_studio	6.3.0
tibco	jaspersoft_studio	6.3.1
tibco	jaspersoft_studio	6.3.2
tibco	jaspersoft_studio	6.4.0
tibco	jaspersoft_studio	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "40E067D3-B67C-4C55-B8C1-CF24054B0788",
              "versionEndIncluding": "6.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FF00ED7-2B4C-4043-A061-84ADFB785C92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D911254B-1935-4971-93E9-4052EC0E83B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0B0408C-9F3F-48A7-A8B4-379B90557E95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B714B874-89AD-49AD-8B8D-2EEDF6804E1C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:community:*:*:*:*:*",
              "matchCriteriaId": "EFA592CF-0110-4061-AFA7-7B6AA80EBF6B",
              "versionEndIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "C0DD94A0-6896-4CA3-A105-16DB5B8421C2",
              "versionEndIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B350CC3F-74B9-4980-86A2-578A2591AE66",
              "versionEndIncluding": "6.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDEEB975-7721-436C-A8EF-62C91A67D5E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C58FDCA-1A2D-48E3-B2C4-6BD60EDEE3A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A77C998E-10BD-49CE-AA25-57D24DE782B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:6.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E28FF909-232C-4C5E-981D-BD5438FD0D28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:6.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "29FE5644-D4B9-404D-9169-2AAF87721234",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "F1A009EF-E826-4F37-BEA4-85CE465358F5",
              "versionEndIncluding": "6.4.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*",
              "matchCriteriaId": "D4795717-92FE-49F3-AF81-5397B138DE40",
              "versionEndIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*",
              "matchCriteriaId": "11DD3FD5-270F-4450-8847-E1E910C4101C",
              "versionEndIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "51CC312D-5DC5-479C-8A17-69AE2BCA3285",
              "versionEndIncluding": "6.2.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "40D22C6F-FF80-4154-AC3D-2D27987E7ACC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFA38684-1870-41E1-B466-470C01E55926",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEE165BF-269E-4964-8051-1AE06A911851",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5D48582-55FC-4D7F-8B01-A649A19A1E9B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:activematrix_bpm:*:*",
              "matchCriteriaId": "762ACA9A-592C-408E-82CC-2064F25249BF",
              "versionEndIncluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el componente de renderizaci\u00f3n de informes en TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio y TIBCO Jaspersoft Studio for ActiveMatrix BPM podr\u00eda permitir que un subconjunto de usuarios autorizados lleve a cabo ataques de Cross-Site Scripting (XSS) persistente. Las versiones afectadas son TIBCO JasperReports Server 6.2.3 y anteriores; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 y anteriores, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 y anteriores, TIBCO JasperReports Library 6.2.3 y anteriores; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 y anteriores, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 y anteriores, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 y anteriores, TIBCO Jaspersoft Studio 6.2.3 y anteriores; 6.3.0; 6.3.1; 6.3.2; 6.4.0 y TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 y anteriores."
    }
  ],
  "id": "CVE-2017-5532",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 4.2,
        "source": "security@tibco.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-11-15T21:29:00.343",
  "references": [
    {
      "source": "security@tibco.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/101873"
    },
    {
      "source": "security@tibco.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/101873"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532"
    }
  ],
  "sourceIdentifier": "security@tibco.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2017-5532 (GCVE-0-2017-5532)

Vulnerability from cvelistv5 – Published: 2017-11-15 21:00 – Updated: 2024-09-16 20:48

Summary

Severity ?

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

CWE

The impact of this vulnerability includes the possibility that a malicious user can gain access to a more privileged account.

Assigner

tibco

References

URL

Tags

	https://www.tibco.com/support/advisories/2017/11/…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/101873	vdb-entryx_refsource_BID

Impacted products

Vendor

Product

Version

TIBCO Software Inc.

TIBCO JasperReports Server

Affected: 6.2.3 and below
Affected: 6.3.0
Affected: 6.3.1
Affected: 6.3.2
Affected: 6.4.0

TIBCO Software Inc.	TIBCO JasperReports Server Community Edition	Affected: 6.4.0 and below
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	Affected: 6.4.0 and below
TIBCO Software Inc.	TIBCO JasperReports Library	Affected: 6.2.3 and below Affected: 6.3.0 Affected: 6.3.1 Affected: 6.3.2 Affected: 6.4.0 Affected: 6.4.1
TIBCO Software Inc.	TIBCO JasperReports Library for ActiveMatrix BPM	Affected: 6.4.1 and below
TIBCO Software Inc.	TIBCO Jaspersoft for AWS with Multi-Tenancy	Affected: 6.4.0 and below
TIBCO Software Inc.	TIBCO Jaspersoft Reporting and Analytics for AWS	Affected: 6.4.0 and below
TIBCO Software Inc.	TIBCO Jaspersoft Studio	Affected: 6.2.3 and below Affected: 6.3.0 Affected: 6.3.1 Affected: 6.3.2 Affected: 6.4.0
TIBCO Software Inc.	TIBCO Jaspersoft Studio for ActiveMatrix BPM	Affected: 6.4.0 and below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:15.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532"
          },
          {
            "name": "101873",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101873"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TIBCO JasperReports Server",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.3 and below"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "6.3.1"
            },
            {
              "status": "affected",
              "version": "6.3.2"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server Community Edition",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0 and below"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0 and below"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Library",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.3 and below"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "6.3.1"
            },
            {
              "status": "affected",
              "version": "6.3.2"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            },
            {
              "status": "affected",
              "version": "6.4.1"
            }
          ]
        },
        {
          "product": "TIBCO JasperReports Library for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.1 and below"
            }
          ]
        },
        {
          "product": "TIBCO Jaspersoft for AWS with Multi-Tenancy",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0 and below"
            }
          ]
        },
        {
          "product": "TIBCO Jaspersoft Reporting and Analytics for AWS",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0 and below"
            }
          ]
        },
        {
          "product": "TIBCO Jaspersoft Studio",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.2.3 and below"
            },
            {
              "status": "affected",
              "version": "6.3.0"
            },
            {
              "status": "affected",
              "version": "6.3.1"
            },
            {
              "status": "affected",
              "version": "6.3.2"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            }
          ]
        },
        {
          "product": "TIBCO Jaspersoft Studio for ActiveMatrix BPM",
          "vendor": "TIBCO Software Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "6.4.0 and below"
            }
          ]
        }
      ],
      "datePublic": "2017-11-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "The impact of this vulnerability includes the possibility that a malicious user can gain access to a more privileged account.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-18T10:57:01",
        "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
        "shortName": "tibco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532"
        },
        {
          "name": "101873",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/101873"
        }
      ],
      "title": "TIBCO JasperReports persistent cross site scripting",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@tibco.com",
          "DATE_PUBLIC": "2017-11-17T17:00:00.000Z",
          "ID": "CVE-2017-5532",
          "STATE": "PUBLIC",
          "TITLE": "TIBCO JasperReports persistent cross site scripting"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "TIBCO JasperReports Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.2.3 and below"
                          },
                          {
                            "version_value": "6.3.0"
                          },
                          {
                            "version_value": "6.3.1"
                          },
                          {
                            "version_value": "6.3.2"
                          },
                          {
                            "version_value": "6.4.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server Community Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.0 and below"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Server for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.0 and below"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Library",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.2.3 and below"
                          },
                          {
                            "version_value": "6.3.0"
                          },
                          {
                            "version_value": "6.3.1"
                          },
                          {
                            "version_value": "6.3.2"
                          },
                          {
                            "version_value": "6.4.0"
                          },
                          {
                            "version_value": "6.4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO JasperReports Library for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.1 and below"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Jaspersoft for AWS with Multi-Tenancy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.0 and below"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Jaspersoft Reporting and Analytics for AWS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.0 and below"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Jaspersoft Studio",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.2.3 and below"
                          },
                          {
                            "version_value": "6.3.0"
                          },
                          {
                            "version_value": "6.3.1"
                          },
                          {
                            "version_value": "6.3.2"
                          },
                          {
                            "version_value": "6.4.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "TIBCO Jaspersoft Studio for ActiveMatrix BPM",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.4.0 and below"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TIBCO Software Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "The impact of this vulnerability includes the possibility that a malicious user can gain access to a more privileged account."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532",
              "refsource": "CONFIRM",
              "url": "https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532"
            },
            {
              "name": "101873",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/101873"
            }
          ]
        },
        "solution": "TIBCO has released updated versions of the affected components which address these issues.\n\nFor each affected system, update to the corresponding software versions:\n\n  TIBCO JasperReports Server versions 6.2.X update to version 6.2.4 or higher\n  TIBCO JasperReports Server versions 6.3.X update to version 6.3.3 or higher\n  TIBCO JasperReports Server version 6.4.0 update to version 6.4.2 or higher\n\n  TIBCO JasperReports Server Community Edition versions 6.4.0 and below update to version 6.4.2 or higher\n\n  TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.0 and below update to version 6.4.2 or higher\n\n  TIBCO JasperReports Library versions 6.2.X update to version 6.2.4 or higher\n  TIBCO JasperReports Library versions 6.3.X update to version 6.3.3 or higher\n  TIBCO JasperReports Library versions 6.4.X update to version 6.4.2 or higher\n\n  TIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.X update to version 6.4.2\n\n  TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.4.0 and below update to version 6.4.2 or higher\n  \n  TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.4.0 and below update to version 6.4.2 or higher\n\n  TIBCO Jaspersoft Studio versions 6.2.X update to version 6.2.4\n  TIBCO Jaspersoft Studio versions 6.3.X update to version 6.3.3\n  TIBCO Jaspersoft Studio version 6.4.0 update to version 6.4.2\n   \n  TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 update to version 6.4.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db",
    "assignerShortName": "tibco",
    "cveId": "CVE-2017-5532",
    "datePublished": "2017-11-15T21:00:00Z",
    "dateReserved": "2017-01-19T00:00:00",
    "dateUpdated": "2024-09-16T20:48:07.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2017-5532

CVE-2017-5532 (GCVE-0-2017-5532)

Tags

Sightings

Nomenclature