CVE-2011-1911
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable...
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
Exploit likelihood
What each source reports
NVD Score used
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
- Record
CVE-2011-1911- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
- Record
CVE-2011-1911- Updated
- 2026-11-02
EUVDEUVD-2011-1909 No score
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
- Record
EUVD-2011-1909- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xffq-rx82-3974 No score
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable...
JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
- Record
GHSA-xffq-rx82-3974- Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1911 is a medium vulnerability (CVSS 6.8) in Jasperforge Jasperreports Server Community Project, published September 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. No source names a fixed version.
References
csirtcv.gva.es/sites/all/files/images/content/%5BCSIRT-cv%5D%20JasperServer%203.7.0%20CE%20CSRF%20Advisory.pdf
exchange.xforce.ibmcloud.com/vulnerabilities/69849
kb.cert.org/vuls/id/519588
securityfocus.com/bid/49649
nvd.nist.gov/vuln/detail/CVE-2011-1911
github.com/advisories/GHSA-xffq-rx82-3974