CVE-2024-3323 HIGH

CVE-2024-3323: Reflected Cross Site Scripting (XSS) vulnerability

Vendor Tibco
Product JasperReports Server
Published April 17, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

What the vulnerability does

01Description

Cross Site Scripting in UI Request/Response Validation in TIBCO JasperReports Server 8.0.4 and 8.2.0 allows allows for the injection of malicious executable scripts into the code of a trusted application that may lead to stealing the user's active session cookie via sending malicious link, enticing the user to interact.

Key dates

02Disclosure timeline

April 17, 2024 CVE published
August 1, 2024 Record updated