nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-5430 CVE-2018-5430
HIGHCISA KEV
TIBCO JasperReports Server Information Disclosure Vulnerability
Record summary
CVE-2018-5430 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit. CISA lists CVE-2018-5430 in KEV.
Description
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Dec 29, 2022 · CISA
- VulnCheck KEV
- Listed · Dec 29, 2022 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationActive
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 7, 2025 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
JasperReportsBrowse TIBCO / JasperReports | CISA | Version data not supplied | |
TIBCO JasperReports ServerBrowse TIBCO Software Inc. / TIBCO JasperReports Server | CVE List | Through 6.2.4 | affected |
| 6.3.0 | affected | ||
| 6.3.2 | affected | ||
| 6.3.3 | affected | ||
| 6.4.0 | affected | ||
| 6.4.2 | affected | ||
TIBCO JasperReports Server Community EditionBrowse TIBCO Software Inc. / TIBCO JasperReports Server Community Edition | CVE List | Through 6.4.2 | affected |
TIBCO JasperReports Server for ActiveMatrix BPMBrowse TIBCO Software Inc. / TIBCO JasperReports Server for ActiveMatrix BPM | CVE List | Through 6.4.2 | affected |
TIBCO Jaspersoft Reporting and Analytics for AWSBrowse TIBCO Software Inc. / TIBCO Jaspersoft Reporting and Analytics for AWS | CVE List | Through 6.4.2 | affected |
TIBCO Jaspersoft for AWS with Multi-TenancyBrowse TIBCO Software Inc. / TIBCO Jaspersoft for AWS with Multi-Tenancy | CVE List | Through 6.4.2 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJasperReports - (Authenticated) File ReadExploitDB exploitby Hector MonsegurNot analyzed1 file
References
5rhinosecuritylabs.com
https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430 44623exploit
https://www.exploit-db.com/exploits/44623 tibco.comConfirmation
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430