Summary
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Asset Suite product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
Vulnerabilities 1
-
High 8.7
Jaspersoft Library Deserialisation Vulnerability
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Revision history
-
#2
Initial Republication of Hitachi Energy PSIRT 8DBD000231 advisory
-
#1
Initial public release
References
-
Jasper Report Vulnerability in Hitachi Energy Asset Suite Product
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000231&LanguageCode=en&DocumentPartId=&Action=launch
-
ICS Advisory ICSA-26-008-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-008-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b