CVE-2017-5532 — Cross-site Scripting in Jasperreports Library

CWE-79 — Cross-site Scripting7 documents6 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 49.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Tibco Jasperreports LibraryTibco Jasperreports ServerTibco Jaspersoft+11 more
Timeline
PublishedNov 15
Latest updateMay 13

Description

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scrip…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages14 packages

🔴Vulnerability Details

3
GHSA
GHSA-cwm8-8754-76qc: A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Serv↗2022-05-13
▶
OSV
CVE-2017-5532: A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Serv↗2017-11-15
▶
CVEList
TIBCO JasperReports persistent cross site scripting↗2017-11-15
▶

📋Vendor Advisories

1
VMware
VMware ESXi and vCenter Server updates address command injection and information disclosure vulnerabilities. (CVE-2017-16544, CVE-2019-5531, CVE-2019-5532, CVE-2019-5534)↗2019-09-16
▶

💬Community

2
Bugzilla
CVE-2017-5532 CVE-2017-5533 jasperreports: various flaws [fedora-all]↗2017-11-23
▶
Bugzilla
CVE-2017-5532 jasperreports: XSS leading to privilege escalation↗2017-11-23
▶
CVE-2017-5532 — Cross-site Scripting | cvebase