VulnerabilityModified

CVE-2017-5529

JasperReports library components contain an information disclosure vulnerability.

MEDIUM 6.5EPSS 1.33%

Does this matter?

Lower severity and a low EPSS score (1.33%). Track it; it rarely justifies an emergency change on its own.

Description

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.33% probability · 69th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: tibco/jasperreports library community edition · tibco/jasperreports library for activematrix bpm · tibco/jasperreports professional · tibco/jasperreports server · tibco/jasperreports server community edition · tibco/jasperreports server for activematrix bpm · tibco/jaspersoft for aws with multi-tenancy · tibco/jaspersoft reporting and analytics for aws · tibco/jaspersoft studio for activematrix bpm
Source: security@tibco.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.