Vulnerability Intelligence Report
TIBCO JasperReports Server credentials disclosure
CVE-2017-5533
A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.
No Active Exploit Signals
CVSS Base Score
9.3
CRITICAL
Exploitability:3.9
Impact Score:4.8
EPSS Probability:1.98%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| TIBCO Software Inc. | TIBCO JasperReports Server | 6.4.0 (affected) |
| TIBCO Software Inc. | TIBCO JasperReports Server Community Edition | 6.4.0 (affected) |
| TIBCO Software Inc. | TIBCO JasperReports Server for ActiveMatrix BPM | 6.4.0 (affected) |
| TIBCO Software Inc. | TIBCO Jaspersoft for AWS with Multi-Tenancy | 6.4.0 (affected) |
| TIBCO Software Inc. | TIBCO Jaspersoft Reporting and Analytics for AWS | 6.4.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.983%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | TIBCO Software Inc. · Vendor · USA |
| Reserved | 2017-01-19T00:00:00 |
| Published | 2017-11-15T21:00:00 |
| Patch Date | 2017-11-17 |
| Last Updated | 2024-09-16T23:06:29 |
Community Chatter & Buzz