CVE-2011-1911 JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery....
MediumCVSS 6.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jasperforge jasperreports server community project | = 3.7.0 | No fix listed |
| jasperforge jasperreports server community project | = 3.7.1 | No fix listed |
References
- www.csirtcv.gva.es
- www.csirtcv.gva.es
- VU#519588 third-party-advisory us-government-resource
- www.kb.cert.org us-government-resource
- 49649 vdb-entry
- jasperreports-flowexecutionkey-csrf(69849) vdb-entry