CVE-2017-5533 : A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails to prevent remote access to all the contents of the web application, including key configuration files. Affected releases are TIBCO JasperReports Server 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.

Published 2017-11-15 21:29:00

Updated 2019-10-03 00:03:26

Source TIBCO Software Inc.

View at NVD, CVE.org

Products affected by CVE-2017-5533

Tibco » Jasperreports Server » Version: 6.4.0 Community Edition
cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:community:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.4.0
cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.4.0 For Activematrix Bpm
cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:activematrix_bpm:*:*
Matching versions
Tibco » Jaspersoft » Version: 6.4.0 For Aws With Multi-tenancy
cpe:2.3:a:tibco:jaspersoft:6.4.0:*:*:*:*:aws_with_multi-tenancy:*:*
Matching versions
Tibco » Jaspersoft Reporting And Analytics » Version: 6.4.0 For AWS
cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:6.4.0:*:*:*:*:aws:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-5533

EPSS FAQ

0.43%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-5533

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.3	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	3.9	4.7	TIBCO Software Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: Low Availability: None

References for CVE-2017-5533

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

CPU Oct 2018

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuapr2020.html

Oracle Critical Patch Update Advisory - April 2020

CVEs referencing this url
http://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-server-2017

TIBCO Security Advisory: November 15, 2017 - TIBCO JasperReports Server - 2017-5533 | TIBCO Software
Issue Tracking;Vendor Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Oracle Critical Patch Update - April 2019

CVEs referencing this url
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

CPU July 2018

CVEs referencing this url
http://www.securityfocus.com/bid/101878

Multiple TIBCO Products CVE-2017-5533 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-5533

Products affected by CVE-2017-5533

Exploit prediction scoring system (EPSS) score for CVE-2017-5533

CVSS scores for CVE-2017-5533

References for CVE-2017-5533