CVE-2025-10492

Published Sep 16, 2025

Last updated 2 months ago

CVSS high 8.7

Overview

Description: A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Source: db6d2600-d19b-4111-a010-f3c4ed70cd50
NVD status: Modified
Products: jasperreports_io, jasperreports_library, jasperreports_server, jasperreports_studio, jasperreports_web_studio

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

db6d2600-d19b-4111-a010-f3c4ed70cd50: CWE-502
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_io:*:*:*:*:at-scale:*:*:*",
            "matchCriteriaId": "EE18AC5A-0750-49DD-8C60-051E2CC4BF21",
            "versionEndIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_io:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "80E88A74-1650-4F7F-8C27-1F1E4340097B",
            "versionEndIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_library:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "F0F18644-0B89-4515-9932-9AD934F4EF44",
            "versionEndIncluding": "7.0.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_library:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "B578C57A-08E7-48BA-AD70-0F70AC76CE1E",
            "versionEndIncluding": "9.0.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D7395E03-A986-433C-9079-B6907D0542CA",
            "versionEndIncluding": "9.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_studio:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "39679BD0-F934-425C-86DC-9DDB0818AE63",
            "versionEndIncluding": "7.0.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_studio:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "546BE369-B456-42EB-B962-FC3DC131AE98",
            "versionEndIncluding": "9.0.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_web_studio:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "79081F65-FE87-440C-B7BE-3F7D6069646B",
            "versionEndIncluding": "3.0.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 4.0

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References