CVE-2017-5533

TIBCO JasperReports Server credentials disclosure

Description

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.

9.3

CVSS

Severity: Critical

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.57%

Vendor Advisory tibco.com

Affected: TIBCO Software Inc. TIBCO JasperReports Server

Affected: TIBCO Software Inc. TIBCO JasperReports Server Community Edition

Affected: TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM

Affected: TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy

Affected: TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-server-2017	vendor advisory issue tracking
http://www.securityfocus.com/bid/101878	third party advisory vdb entry
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/security-alerts/cpuapr2020.html

Frequently Asked Questions

What is the severity of CVE-2017-5533?: CVE-2017-5533 has been scored as a critical severity vulnerability.
How to fix CVE-2017-5533?: To fix CVE-2017-5533, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2017-5533 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2017-5533 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2017-5533?: CVE-2017-5533 affects TIBCO Software Inc. TIBCO JasperReports Server, TIBCO Software Inc. TIBCO JasperReports Server Community Edition, TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS.