CVEvulnerability

CVE-2018-5430

8.8 HIGH Known exploited Published 2018-04-17 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

TIBCO JasperReports Server Information Disclosure Vulnerability — TIBCO JasperReports

TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

Added to KEV: 2022-12-29
Remediation due: 2023-01-19
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430

Status: Analyzed
Published: 2018-04-17
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected]): 7.7 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected]): 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses: CWE-200, CWE-22

Description

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected configurations

• tibco jasperreports server (<= 6.2.4) • tibco jasperreports server (<= 6.4.2) • tibco jasperreports server 6.3.0 • tibco jasperreports server 6.3.2 • tibco jasperreports server 6.3.3 • tibco jasperreports server 6.4.0 • tibco jasperreports server 6.4.2 • tibco jaspersoft (<= 6.4.2) • tibco jaspersoft reporting and analytics (<= 6.4.2)

Weakness · CWE (2)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References