CVE-2024-3325 is a high severity (CVSS 7.2) improper privilege management flaw in Jaspersoft JasperReports Server, affecting versions 8.0.4 through 9.0.0. Jaspersoft published a security advisory on 9 July 2024. Read it for the exact fixed release for your version line, then upgrade and tighten administrator access.
What's affected
The record says the issue affects JasperReports Server from 8.0.4 through 9.0.0. The NVD configuration data lists the unversioned product, 8.2.0 and 9.0.0 explicitly. The record description is short and does not explain the mechanism. It names no fixed version.
The weakness is CWE-269, improper privilege management. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. That means network reachable and low complexity, but the attacker needs a high privilege account first. Impact on confidentiality, integrity and availability is rated high, which gives 7.2.
The one reference is the Jaspersoft community advisory titled as the July 9, 2024 security advisory for JasperReports Server, CVE-2024-3325. The page returned an HTTP 403 error when I tried to load it, so I could not confirm the fixed versions or any workaround from the vendor. I will not guess them. Open the advisory in a browser and read the remediation section.
I found no statement in the record that this flaw is exploited in the wild, and it is not marked as a CISA Known Exploited Vulnerability.
How to check if you're exposed
- Sign in to JasperReports Server as an administrator and open the About screen, or read the version from the login page footer, to get the exact version.
- If the version falls between 8.0.4 and 9.0.0 inclusive, you are in scope.
- List who holds administrator and other high privilege roles. The vector requires a high privilege account, so the number of such accounts sets your exposure.
- Check whether the server is reachable from the internet or only from an internal network.
- Check how the server was installed. A bundled installer, a WAR file on your own Tomcat and a container image each update differently.
What to do now
- Read the Jaspersoft advisory and note the fixed version for your release line.
- Schedule the upgrade, testing your reports and data sources on a staging copy first.
- Until you upgrade, reduce the number of administrator accounts and remove any you do not need.
- Turn on multi factor authentication in front of the server if your sign in setup supports it, so a stolen administrator password is not enough.
- Review the audit log for role changes and unexpected administrator activity.
- Restrict network access to the server's admin interface.
Why it matters
Privilege management flaws are about what an account is allowed to do once it has signed in. A reporting server connects to databases and holds credentials for them, so high privilege access can lead to data sources the server can reach. The record rates all three impacts as high for that reason.
The need for an administrator account makes this harder to abuse than an unauthenticated bug. It does not make it harmless. Stolen or shared administrator credentials are common, and a flaw that raises what such an account can do widens the damage. Patch on your normal high severity schedule and tighten administrator access while you do.
Quick check
Which JasperReports Server version fixes CVE-2024-3325?
The record does not say, and I could not load the advisory. The advisory on the Jaspersoft community site lists the fixed release, so check it before you plan the upgrade.
Does the attacker need an account?
Yes. The vector requires a high privilege account, which lowers the chance of casual abuse but does not remove the risk from stolen administrator credentials.
Sources
- NVD record for CVE-2024-3325
- Jaspersoft security advisory, 9 July 2024 (referenced by the record; could not be loaded)
Last reviewed: 19 October 2026.
