HTML Injection The advisory has been revoked - it doesn't affect any version of package net.sf.jasperreports:jasperreports Open this link in a new tab

Threat Intelligence

EPSS 0.18% (55^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JAVA-NETSFJASPERREPORTS-570052
published 21 May 2020
disclosed 19 May 2020
credit Unknown

Report a new vulnerability Found a mistake?

Introduced: 19 May 2020

CVE-2020-9410 Open this link in a new tab CWE-79 Open this link in a new tab

Amendment

This was deemed not a vulnerability.

Overview

net.sf.jasperreports:jasperreports is an open source reporting engine for Java.

Affected versions of this package are vulnerable to HTML Injection. The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker.

References

Security Advisory