| Name | CVE-2017-14941 |
| Description | Jaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 880467, 884131 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| jasperreports (PTS) | jessie | 4.1.3+dfsg-3 | undetermined |
| stretch | 6.2.2-3 | undetermined |
The information below is based on the following data on fixed versions.
Notes
[jessie] - jasperreports <ignored> (no detailed information available, only needed as build-dependency for Spring)
[wheezy] - jasperreports <end-of-life> (cannot be supported due to lack of information)
https://github.com/binary1985/VulnerabilityDisclosure/blob/master/JasperSoft%20JasperReports%20-%204.7%20-%20CVE-2017-14941