What is the CVSS score of CVE-2017-5529?

CVE-2017-5529 has a CVSS 3.0 base score of 4.1 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Jasperreports Server CVE-2017-5529

MEDIUM

Information Exposure (CWE-200)

2017-06-29 security@tibco.com

Information Disclosure Jasperreports Server Jasperreports Library Community Edition Jasperreports Library For Activematrix Bpm Jasperreports Professional Jasperreports Server Community Edition Jasperreports Server For Activematrix Bpm Jaspersoft For Aws With Multi Tenancy Jaspersoft Reporting And Analytics For Aws Jaspersoft Studio For Activematrix Bpm Tibco

4.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.1 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 29, 2017 - 14:29 cve.org

MEDIUM 4.1

DescriptionCVE.org

JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).

AnalysisAI

JasperReports library components contain an information disclosure vulnerability. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below). Affected products include: Tibco Jasperreports Library Community Edition, Tibco Jasperreports Library For Activematrix Bpm, Tibco Jasperreports Professional, Tibco Jasperreports Server, Tibco Jasperreports Server Community Edition.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.