CVE-2017-14941

NameCVE-2017-14941
DescriptionJaspersoft JasperReports 4.7 suffers from a saved credential disclosure vulnerability, which allows a remote authenticated user to retrieve stored Data Source passwords by accessing flow.html and reading the HTML source code of the page reached in an Edit action for a Data Source connector.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs880467, 884131

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jasperreportssourcewheezy(unfixed)end-of-life
jasperreportssource(unstable)undetermined880467, 884131

Notes

[jessie] - jasperreports <ignored> (no detailed information available, only needed as build-dependency for Spring)
[wheezy] - jasperreports <end-of-life> (cannot be supported due to lack of information)
https://github.com/binary1985/VulnerabilityDisclosure/blob/master/JasperSoft%20JasperReports%20-%204.7%20-%20CVE-2017-14941
Search for package or bug name: Reporting problems