CVE-2011-1911

MEDIUM 6.8CVE-2011-1911 · Published 20/09/2011 · updated 16/06/2026

In short

CVE-2011-1911 is a MEDIUM (CVSS 6.8) vulnerability affecting jasperreports server community project (jasperforge).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
jasperreports server community project jasperforge	`= 3.7.0= 3.7.1`	No fix yet

Description

JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.

References

csirtcv.gva.es/es/alertas/vulnerabilidad-en-jasperserver.html
csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf
kb.cert.org/vuls/id/519588 · US Government Resource
kb.cert.org/vuls/id/MAPG-8ELLJC · US Government Resource
securityfocus.com/bid/49649
exchange.xforce.ibmcloud.com/vulnerabilities/69849

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free