CVE-2017-5529
Estado: ModificadaMedia (6.5)—
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 6.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.33%
- Percentil entre todas las CVEs puntuadas: 70
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (9)
Tibco — Jasperreports Library Community EditionTibco — Jasperreports Library FOR Activematrix BPMTibco — Jasperreports ProfessionalTibco — Jasperreports ServerTibco — Jasperreports Server Community EditionTibco — Jasperreports Server FOR Activematrix BPMTibco — Jaspersoft FOR AWS With Multi-tenancyTibco — Jaspersoft Reporting AND Analytics FOR AWSTibco — Jaspersoft Studio FOR Activematrix BPM
CWE
- CWE-200
Referencias
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0
JSON original (NVD)
Mostrar
{
"id": "CVE-2017-5529",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"authentication": "SINGLE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "security@tibco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 4.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.3
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@tibco.com",
"affectedData": [
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Library Community Edition",
"versions": [
{
"status": "affected",
"version": "6.4.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Library for ActiveMatrix BPM",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.2.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Professional",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.2.1"
},
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Server",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.1.1"
},
{
"status": "affected",
"version": "6.2.0"
},
{
"status": "affected",
"version": "6.2.1"
},
{
"status": "affected",
"version": "6.3.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Server Community Edition",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.3.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO JasperReports Server for ActiveMatrix BPM",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.2.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO Jaspersoft for AWS with Multi-Tenancy",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.3.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO Jaspersoft Reporting and Analytics for AWS",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.3.0"
}
]
},
{
"vendor": "TIBCO Software Inc.",
"product": "TIBCO Jaspersoft Studio for ActiveMatrix BPM",
"versions": [
{
"status": "affected",
"version": "unspecified",
"versionType": "custom",
"lessThanOrEqual": "6.2.0"
}
]
}
]
}
],
"published": "2017-06-29T14:29:00.210",
"references": [
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"source": "security@tibco.com"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"source": "security@tibco.com"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"source": "security@tibco.com"
},
{
"url": "https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0",
"tags": [
"Vendor Advisory"
],
"source": "security@tibco.com"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-june-28-2017-tibco-jasperreports-server-2017-0",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below)."
},
{
"lang": "es",
"value": "Los componentes de la biblioteca JasperReports contienen una vulnerabilidad de divulgación de información. Esta vulnerabilidad incluye la divulgación, en teoría, de cualquier información accesible desde el sistema de archivos del host. Afecta a TIBCO JasperReports Library Community Edition (versiones 6.4.0 y anteriores), TIBCO JasperReports Library for ActiveMatrix BPM (versiones 6.2.0 y anteriores), TIBCO JasperReports Professional (versiones 6.2.1 y anteriores y la versión 6.3.0), TIBCO JasperReports Server (versiones 6.1.1 y anteriores, 6.2.0, 6.2.1 y 6.3.0), TIBCO JasperReports Server Community Edition (versiones 6.3.0 y anteriores), TIBCO JasperReports Server for ActiveMatrix BPM (versiones 6.2.0 y anteriores), TIBCO Jaspersoft for AWS with Multi-Tenancy (versiones 6.3.0 y anteriores), TIBCO Jaspersoft Reporting and Analytics for AWS (versiones 6.3.0 y anteriores) y TIBCO Jaspersoft Studio for ActiveMatrix BPM (versiones 6.2.0 y anteriores)."
}
],
"lastModified": "2026-06-17T01:20:40.973",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_library_community_edition:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92BADDE3-0215-4B61-9EF4-EBEBCDDC618F",
"versionEndIncluding": "6.4.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_library_for_activematrix_bpm:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C41772A-63F9-4CCD-8DBE-105F8A2EF59B",
"versionEndIncluding": "6.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_professional:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "053B3DCB-B3DA-4257-940D-D95041266461",
"versionEndIncluding": "6.2.1"
},
{
"criteria": "cpe:2.3:a:tibco:jasperreports_professional:6.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "117FDD9C-EC7B-4102-B90C-5B3BF67143C4"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB779293-3B1E-4EFA-9949-194F50DF7829",
"versionEndIncluding": "6.1.1"
},
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1A9B006-2D34-4F4B-90D2-3AA6F4008C5E"
},
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09B3F43A-CBE2-4E1C-B2D8-CABDDE37E639"
},
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FF00ED7-2B4C-4043-A061-84ADFB785C92"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server_community_edition:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36FAD9BF-8E18-4547-8F86-3ECB0625C82A",
"versionEndIncluding": "6.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jasperreports_server_for_activematrix_bpm:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BAD91052-9CD6-46CC-A8C1-97B4C728E4FC",
"versionEndIncluding": "6.2.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jaspersoft_for_aws_with_multi-tenancy:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BDDCA701-8160-40CC-9BB9-A1325EB7ABD6",
"versionEndIncluding": "6.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics_for_aws:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1C80725-2AEE-4A9D-A5E4-4747359AA7CE",
"versionEndIncluding": "6.3.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tibco:jaspersoft_studio_for_activematrix_bpm:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CB2E7DF-C120-47DF-B1A4-063E91824560",
"versionEndIncluding": "6.2.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@tibco.com"
}