title: TIBCO JasperReports persistent cross site scripting
description: A vulnerability in the report renderer component of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow a subset of authorized users to perform persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy 6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.
problem types: The impact of this vulnerability includes the possibility that a malicious user can gain access to a more privileged account.
affected:
{
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.3 and below
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.3.2
status: affected, version: 6.4.0
}
{
product: TIBCO JasperReports Server Community Edition
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.0 and below
}
{
product: TIBCO JasperReports Server for ActiveMatrix BPM
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.0 and below
}
{
product: TIBCO JasperReports Library
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.3 and below
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.3.2
status: affected, version: 6.4.0
status: affected, version: 6.4.1
}
{
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.1 and below
}
{
product: TIBCO Jaspersoft for AWS with Multi-Tenancy
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.0 and below
}
{
product: TIBCO Jaspersoft Reporting and Analytics for AWS
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.0 and below
}
{
product: TIBCO Jaspersoft Studio
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.2.3 and below
status: affected, version: 6.3.0
status: affected, version: 6.3.1
status: affected, version: 6.3.2
status: affected, version: 6.4.0
}
{
product: TIBCO Jaspersoft Studio for ActiveMatrix BPM
vendor: TIBCO Software Inc.
versions:
status: affected, version: 6.4.0 and below
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.0
]