Credential Disclosure in Jaspersoft JasperReports by TIBCO Software
CVE-2017-14941

6.5MEDIUM

Key Information:

Vendor

Jaspersoft

Status
Jasperreports
Vendor
CVE Published:
2 October 2017

What is CVE-2017-14941?

Jaspersoft JasperReports 4.7 presents a saved credential disclosure vulnerability, enabling a remote authenticated user to access sensitive Data Source passwords. By executing an Edit action on a Data Source connector and analyzing the HTML source of the resulting flow.html page, unauthorized retrieval of these credentials can occur, potentially compromising data security within applications using this reporting tool.

References

https://github.com/binary1985/VulnerabilityDisclosure/blo...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.