CVE-2017-1370 : IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive informatio

IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863.

Published 2017-07-31 21:29:01

Updated 2019-10-03 00:03:26

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2017-1370

IBM » Jazz Reporting Service » Version: 5.0.2
cpe:2.3:a:ibm:jazz_reporting_service:5.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 5.0
cpe:2.3:a:ibm:jazz_reporting_service:5.0:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 6.0
cpe:2.3:a:ibm:jazz_reporting_service:6.0:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 5.0.1
cpe:2.3:a:ibm:jazz_reporting_service:5.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 6.0.1
cpe:2.3:a:ibm:jazz_reporting_service:6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 6.0.2
cpe:2.3:a:ibm:jazz_reporting_service:6.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 6.0.3
cpe:2.3:a:ibm:jazz_reporting_service:6.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Jazz Reporting Service » Version: 6.0.4
cpe:2.3:a:ibm:jazz_reporting_service:6.0.4:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-1370

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-1370

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.9	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-1370

CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-1370

https://exchange.xforce.ibmcloud.com/vulnerabilities/126863

IBM Jazz Reporting Service information disclosure CVE-2017-1370 Vulnerability Report
VDB Entry;Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22005868

IBM Security Bulletin: Security vulnerability affects the Report Builder that is shipped with Jazz Reporting Service (CVE-2017-1370)
Vendor Advisory
http://www.securityfocus.com/bid/99954

IBM Jazz Reporting Service CVE-2017-1370 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-1370

Products affected by CVE-2017-1370

Exploit prediction scoring system (EPSS) score for CVE-2017-1370

CVSS scores for CVE-2017-1370

CWE ids for CVE-2017-1370

References for CVE-2017-1370