CVE-2024-3323: 
TIBCO JasperReports Server vulnerability analysis and mitigation

Cross Site Scripting (XSS) vulnerability has been identified in TIBCO JasperReports Server versions 8.0.4 and 8.2.0. The vulnerability exists in the UI Request/Response Validation component, which allows for the injection of malicious executable scripts into the code of a trusted application (TIBCO Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 8.3 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L. This indicates that the vulnerability requires high privileges and user interaction to exploit, but can potentially lead to significant impact on confidentiality and integrity (TIBCO Advisory).

If successfully exploited, the vulnerability may lead to stealing the user's active session cookie through malicious link interaction. The attack requires enticing the user to interact with a specially crafted malicious link (TIBCO Advisory).

The vulnerability requires high privileges and user interaction to exploit. An attacker needs to send a malicious link and convince the user to interact with it to potentially steal their active session cookie (TIBCO Advisory).