CVE-2025-10492

Jaspersoft Library Deserialisation Vulnerability

CVSS 8.7 HIGHEPSS 0.9%CWE-502

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

Jaspersoft · JasperReports IO At-Scale Jaspersoft · JasperReports IO Professional Jaspersoft · JasperReports Library Community Edition Jaspersoft · JasperReports Library Professional Jaspersoft · JasperReports Server Jaspersoft · JasperReports Web Studio Jaspersoft · Jaspersoft Studio Community Edition Jaspersoft · Jaspersoft Studio Professional

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition