CVE-2017-5532

A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.

• CWE-79

• http://www.securityfocus.com/bid/101873Issue Tracking, Third Party Advisory, VDB Entry
• https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532Issue Tracking, Vendor Advisory
• http://www.securityfocus.com/bid/101873Issue Tracking, Third Party Advisory, VDB Entry
• https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-november-15-2017-tibco-jasperreports-2017-5532Issue Tracking, Vendor Advisory

Published

Nov 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5526Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator…6.5
• CVE-2017-5527TIBCO Spotfire Server 7.0.X before 7.0.2, 7.5.x before 7.5.1…4.3
• CVE-2017-5528Multiple JasperReports Server components contain vulnerabili…8.8
• CVE-2017-5529JasperReports library components contain an information disc…4.1
• CVE-2017-5530The tibbr web server components of tibbr Community, and tibb…8.1
• CVE-2017-5531Deployments of TIBCO Managed File Transfer Command Center ve…8
• CVE-2017-5533A vulnerability in the server content cache of TIBCO JasperR…9.3
• CVE-2017-5534The tibbr user profiles components of tibbr Community, and t…8.8
• CVE-2017-5535The GridServer Broker, GridServer Driver, and GridServer Eng…6.8
• CVE-2017-5536The GridServer Broker, and GridServer Director components of…6.3
• CVE-2017-5537The password reset form in Weblate before 2.10.1 provides di…
• CVE-2017-5538The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core…