2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["UI Request/Response Validation"],"product":"JasperReports Server","vendor":"TIBCO","versions":[{"lessThan":"8.0.4","status":"affected","version":"8.0","versionType":"Hotfix"},{"lessThan":"8.2.0","status":"affected","version":"8.2","versionType":"Hotfix"}]}],"source":"security@tibco.com"},{"affectedData":[{"cpes":["cpe:2.3:a:tibco:jasperreports_server:8.0.4:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"jasperreports_server","vendor":"tibco","versions":[{"status":"affected","version":"8.0.4"}]},{"cpes":["cpe:2.3:a:tibco:jasperreports_server:8.2.0:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"jasperreports_server","vendor":"tibco","versions":[{"status":"affected","version":"8.2.0"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross Site Scripting in \n\nUI Request/Response Validation\n\n in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executable scripts into the code of a trusted application that may lead to stealing the user's active session cookie via sending malicious link, enticing the user to interact."},{"lang":"es","value":"Cross Site Scripting en la validación de solicitud/respuesta de UI en TIBCO JasperReports Server 8.0.4 y 8.2.0 permite la inyección de scripts ejecutables maliciosos en el código de una aplicación confiable que pueden llevar a robar la cookie de sesión activa del usuario mediante el envío de un enlace malicioso, incitando al usuario a interactuar."}],"id":"CVE-2024-3323","lastModified":"2026-06-17T07:43:47.157","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":1.7,"impactScore":6.0,"source":"security@tibco.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-3323","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-04-22T21:35:25.685169Z","version":"2.0.3"}}]},"published":"2024-04-17T19:15:08.177","references":[{"source":"security@tibco.com","url":"https://community.tibco.com/advisories/tibco-security-advisory-april-9-2024-tibco-jasperreports-server-cve-2024-3323-r209/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://community.tibco.com/advisories/tibco-security-advisory-april-9-2024-tibco-jasperreports-server-cve-2024-3323-r209/"}],"sourceIdentifier":"security@tibco.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|