CVE-2018-18816

HIGH

TIBCO JasperReports Server <= 6.3.4; 6.4.0-6.4.3; 7.1.0 - Stored Cross-Site Scripting in Repository Component

Title source: llm
STIX 2.1

Description

The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi- Tenancy versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
http://www.tibco.com/services/support/advisories
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/107348

Scores

CVSS v3 8.0
EPSS 0.0024
EPSS Percentile 47.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-79
Status published
Products (10)
tibco/jasperreports_server 6.4.0
tibco/jasperreports_server 6.4.1
tibco/jasperreports_server 6.4.2
tibco/jasperreports_server 6.4.3
tibco/jasperreports_server 7.1.0
tibco/jasperreports_server < 6.3.4
tibco/jasperreports_server < 6.4.3
tibco/jasperreports_server < 7.1.0
tibco/jaspersoft < 7.1.0
tibco/jaspersoft_reporting_and_analytics < 7.1.0
Published Mar 07, 2019
Tracked Since Feb 18, 2026