CVE-2025-10492

Published Sep 16, 2025

Last updated 3 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-10492 is a Java deserialization vulnerability identified in the Jaspersoft Library. This flaw stems from the improper handling of externally supplied data during the deserialization process, which can allow attackers to execute arbitrary code remotely on systems utilizing the affected library. The vulnerability impacts various Jaspersoft products, including JasperReports Library (Community & Professional editions), JasperReports Server, JasperReports Studio, and JasperReports IO editions. Exploitation typically involves providing malicious JRXML report templates or compiled `.jasper` report templates, which, when loaded and deserialized by the application, can lead to remote code execution.

Description: A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Source: db6d2600-d19b-4111-a010-f3c4ed70cd50
NVD status: Modified
Products: jasperreports_io, jasperreports_library, jasperreports_server, jasperreports_studio, jasperreports_web_studio

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

db6d2600-d19b-4111-a010-f3c4ed70cd50: CWE-502
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_io:*:*:*:*:at-scale:*:*:*",
            "matchCriteriaId": "EE18AC5A-0750-49DD-8C60-051E2CC4BF21",
            "versionEndIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_io:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "80E88A74-1650-4F7F-8C27-1F1E4340097B",
            "versionEndIncluding": "4.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_library:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "F0F18644-0B89-4515-9932-9AD934F4EF44",
            "versionEndIncluding": "7.0.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_library:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "B578C57A-08E7-48BA-AD70-0F70AC76CE1E",
            "versionEndIncluding": "9.0.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_server:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D7395E03-A986-433C-9079-B6907D0542CA",
            "versionEndIncluding": "9.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_studio:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "39679BD0-F934-425C-86DC-9DDB0818AE63",
            "versionEndIncluding": "7.0.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_studio:*:*:*:*:professional:*:*:*",
            "matchCriteriaId": "546BE369-B456-42EB-B962-FC3DC131AE98",
            "versionEndIncluding": "9.0.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cloud:jasperreports_web_studio:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "79081F65-FE87-440C-B7BE-3F7D6069646B",
            "versionEndIncluding": "3.0.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.