TIBCO JasperReports Library Information Disclosure
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
JasperReports library components contain an information disclosure vulnerability. This vulnerability includes the theoretical disclosure of any accessible information from the host file system. Affects TIBCO JasperReports Library Community Edition (versions 6.4.0 and below), TIBCO JasperReports Library for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO JasperReports Professional (versions 6.2.1 and below, and 6.3.0), TIBCO JasperReports Server (versions 6.1.1 and below, 6.2.0, 6.2.1, 6.3.0), TIBCO JasperReports Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with Multi-Tenancy (versions 6.3.0 and below), TIBCO Jaspersoft Reporting and Analytics for AWS (versions 6.3.0 and below), and TIBCO Jaspersoft Studio for ActiveMatrix BPM (versions 6.2.0 and below).
Why it matters now
EPSS 0.01329 71st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO JasperReports Library Community Edition | 6.4.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library for ActiveMatrix BPM | up to 6.2.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Professional | up to 6.2.1; 6.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server | up to 6.1.1; 6.2.0; 6.2.1; 6.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server Community Edition | up to 6.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for ActiveMatrix BPM | up to 6.2.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft for AWS with Multi-Tenancy | up to 6.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Reporting and Analytics for AWS | up to 6.3.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Studio for ActiveMatrix BPM | up to 6.2.0 | — | No fix listed | CNA |
- TIBCO JasperReports Library Community Edition VendorTIBCO Affected 6.4.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Library for ActiveMatrix BPM VendorTIBCO Affected up to 6.2.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Professional VendorTIBCO Affected up to 6.2.1; 6.3.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server VendorTIBCO Affected up to 6.1.1; 6.2.0; 6.2.1; 6.3.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server Community Edition VendorTIBCO Affected up to 6.3.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for ActiveMatrix BPM VendorTIBCO Affected up to 6.2.0 Fixed in — No fix listed CNA
- TIBCO Jaspersoft for AWS with Multi-Tenancy VendorTIBCO Affected up to 6.3.0 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Reporting and Analytics for AWS VendorTIBCO Affected up to 6.3.0 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Studio for ActiveMatrix BPM VendorTIBCO Affected up to 6.2.0 Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_library_community_edition:*:*:*:*:*:*:*:* | up to 6.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library_for_activematrix_bpm:*:*:*:*:*:*:*:* | up to 6.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_professional:*:*:*:*:*:*:*:* | up to 6.2.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_professional:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* | up to 6.1.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.2.0:*:*:*:*:*:*:* | 6.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.2.1:*:*:*:*:*:*:* | 6.2.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server_community_edition:*:*:*:*:*:*:*:* | up to 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server_for_activematrix_bpm:*:*:*:*:*:*:*:* | up to 6.2.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_library_community_edition:*:*:*:*:*:*:*:* Versions up to 6.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library_for_activematrix_bpm:*:*:*:*:*:*:*:* Versions up to 6.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_professional:*:*:*:*:*:*:*:* Versions up to 6.2.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_professional:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* Versions up to 6.1.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.2.0:*:*:*:*:*:*:* Versions 6.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server_community_edition:*:*:*:*:*:*:*:* Versions up to 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server_for_activematrix_bpm:*:*:*:*:*:*:*:* Versions up to 6.2.0 Vulnerable ·TIBCO
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jaspersoft_for_aws_with_multi-tenancy:*:*:*:*:*:*:*:* | up to 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics_for_aws:*:*:*:*:*:*:*:* | up to 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio_for_activematrix_bpm:*:*:*:*:*:*:*:* | up to 6.2.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jaspersoft_for_aws_with_multi-tenancy:*:*:*:*:*:*:*:* Versions up to 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics_for_aws:*:*:*:*:*:*:*:* Versions up to 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio_for_activematrix_bpm:*:*:*:*:*:*:*:* Versions up to 6.2.0 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-5529
- 2026-10-03 Alias added: GHSA-c4qf-w393-rfcw
References
Sources
- CVE-2017-5529 · CVE Program
- CVE-2017-5529 · NVD
- FIRST EPSS
- GHSA-c4qf-w393-rfcw · GitHub Advisory Database · CC BY 4.0
- CVE-2017-5529 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences