CVE-2024-3325

What it actually does

The vulnerability permits a high-privileged network attacker to fully compromise confidentiality, integrity, and availability of the JasperReport Server instance.

Why it matters to the business

Successful exploitation can result in unauthorized access to sensitive reports and data, potential service disruption, and loss of trust in business intelligence systems; low EPSS and no known exploitation reduce immediate risk but high CVSS warrants prompt attention given the age of the disclosure.

How an attack unfolds

An attacker authenticates using an existing high-privilege account, crafts and sends specially formed requests to the affected server versions, and leverages the flaw to execute actions that breach the server’s data and functionality.

How to fix it

Upgrade JasperReport Server to the latest fixed version beyond 9.0.0 as soon as it becomes available from the vendor; restrict administrative access in the interim and monitor for abnormal privileged activity.

How to confirm the fix worked

Inventory all JasperReport Server deployments and confirm none are running versions 8.0.4 through 9.0.0; re-test after applying vendor updates to ensure the vulnerable range is no longer present.

Typical attack path

1. Obtain or compromise a high-privileged account on the JasperReport Server
2. Send malicious network requests targeting the vulnerable endpoints in versions 8.0.4 through 9.0.0
3. Achieve full control over server data and operations

How to detect it

Examine JasperReport Server access and application logs for anomalous requests originating from high-privilege accounts; correlate with network traffic to the server over the publication period.

What your security team should do

• Immediately identify and isolate any JasperReport Server instances in the affected version range
• Apply vendor patches or upgrades as soon as released
• Enforce least-privilege access for all administrative accounts
• Increase logging and alerting on privileged operations until remediation is complete