CVE-2017-14941
The MITRE CVE dictionary describes this issue as:
Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector.
Find out more about CVE-2017-14941 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
Red Hat Product Security is not aware of any supported product that ships the affected component.
CVSS v3 metrics
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 6.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity Impact | None |
| Availability Impact | None |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| RHEV Manager 3 | jasperreports-server-pro | Will not fix |
CVE description copyright © 2017, The MITRE Corporation