Multiple JasperReports Server components contain vulnerabilities which may allow authorized users to perform cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. The impact of this vulnerability includes the theoretical disclosure of sensitive information. Affects TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.2.0 and below).

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)     (CVE-2017-17485)

  - A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS     protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that     allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to     validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to     validation/Cas20ServiceTicketValidator.java. (CVE-2014-4172)

  - An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the     value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to     'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do     not have a sub-element to declare explicit data binding property mappings. (CVE-2017-4971)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Detections

Analytics

CVE-2017-5528

high

Tenable Plugins

critical