CVE-2017-5528

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
TIBCO Software Inc.	TIBCO JasperReports Server	>= unspecified, <= 6.1.1; 6.2.0; 6.2.1; 6.3.0
TIBCO Software Inc.	TIBCO JasperReports Server Community Edition	>= unspecified, <= 6.3.0
TIBCO Software Inc.	TIBCO JasperReports Server for ActiveMatrix BPM	>= unspecified, <= 6.2.0
TIBCO Software Inc.	TIBCO Jaspersoft for AWS with Multi-Tenancy	>= unspecified, <= 6.3.0
TIBCO Software Inc.	TIBCO Jaspersoft Reporting and Analytics for AWS	>= unspecified, <= 6.3.0

References

Timeline

Published: Jun 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-55296.5JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of CVE-2017-55308.1The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized us CVE-2017-55318.8Deployments of TIBCO Managed File Transfer Command Center versions 8.0.0 and 8.0.1 and TIBCO Managed File Transfer Internet Server versions CVE-2017-55325.4A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperRe CVE-2017-55339.8A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports CVE-2017-55348.8The tibbr user profiles components of tibbr Community, and tibbr Enterprise expose a weakness in an improperly sandboxed third-party compone CVE-2017-55356.8The GridServer Broker, GridServer Driver, and GridServer Engine components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager conta CVE-2017-55365.4The GridServer Broker, and GridServer Director components of TIBCO Software Inc. TIBCO DataSynapse GridServer Manager contain vulnerabilitie CVE-2017-55375.3The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with CVE-2017-55389.8The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) and N(7.0) software an CVE-2017-55399.1The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ t CVE-2017-55415.3Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to renam