CVE-2024-3323 - CVE House
Back to Database
Status published High CVE-2024-3323

Reflected Cross Site Scripting (XSS) vulnerability

Vulnerability Description

Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executable scripts into the code of a trusted application that may lead to stealing the user's active session cookie via sending malicious link, enticing the user to interact.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3323

Credits & Attribution

No credits recorded in the NVD database.

References

More from TIBCO

View All →
CVE-2024-3182
Install-type password disclosure vulnerability in Universal Installer including the Silent Installer...
Medium 6.5
CVE-2017-3181
Multiple TIBCO Spotfire components are vulnerable to multiple unspecified SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query
Critical 9.8
CVE-2017-3180
Multiple TIBCO Spotfire components fail to sanitize user-supplied inout and are vulnerable to cross-site scripting
Medium 5.4

Affected Vendor

Affected Software

JasperReports Server
Vulnerable Versions:
8.0, 8.2

Timeline

Official Publish: April 17th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.