https://bugzilla.redhat.com/show_bug.cgi?id=1474286
Bug ID: 1474286
Summary: CVE-2017-5528 jasperrreports: XSS and CSRF
vulnerabilities leading to information disclosure
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bmcclain(a)redhat.com, dblechte(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, puntogil(a)libero.it,
rbalakri(a)redhat.com, Rhev-m-bugs(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
ydary(a)redhat.com, ykaul(a)redhat.com
The JasperReports Server components listed above contain vulnerabilities which
may allow authorized users to perform cross-site scripting (XSS) and cross-site
request forgery (CSRF) attacks. The impact of this vulnerability includes the
theoretical disclosure of sensitive information. Affects TIBCO JasperReports
Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports
Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server
for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with
Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and
Analytics for AWS (versions 6.2.0 and below).
External References:
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.