VulnerabilityModified
CVE-2011-1911
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
MEDIUM 6.8EPSS 1.49%
Does this matter?
Lower severity and a low EPSS score (1.49%). Track it; it rarely justifies an emergency change on its own.
Description
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.49% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- jasperforge/jasperreports server community project
- Source
- cret@cert.org
References
- http://www.csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html
- http://www.csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf
- http://www.kb.cert.org/vuls/id/519588US Government Resource
- http://www.kb.cert.org/vuls/id/MAPG-8ELLJCUS Government Resource
- http://www.securityfocus.com/bid/49649
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69849
- http://www.csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html
- http://www.csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf
- http://www.kb.cert.org/vuls/id/519588US Government Resource
- http://www.kb.cert.org/vuls/id/MAPG-8ELLJCUS Government Resource
- http://www.securityfocus.com/bid/49649
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69849
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.