PT-2018-16949 · Tibco · Jasperreports Library+10

Publicado 2018-04-17 · Atualizado 2019-10-09 · CVE-2018-5429

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions up to and including 6.4.2 TIBCO JasperReports Server Community Edition versions up to and including 6.4.2 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.2 TIBCO JasperReports Library versions up to and including 6.4.2 TIBCO JasperReports Library Community Edition versions up to and including 6.4.3 TIBCO JasperReports Library for ActiveMatrix BPM versions up to and including 6.4.2 TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 6.4.2 TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 6.4.2 TIBCO Jaspersoft Studio versions up to and including 6.4.2 TIBCO Jaspersoft Studio Community Edition versions up to and including 6.4.3 TIBCO Jaspersoft Studio for ActiveMatrix BPM versions up to and including 6.4.2

Description A vulnerability in the report scripting component may allow analytic reports that contain scripting to perform arbitrary code execution.

Recommendations For TIBCO JasperReports Server versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO JasperReports Server Community Edition versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO JasperReports Library versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO JasperReports Library Community Edition versions up to and including 6.4.3, update to a version later than 6.4.3. For TIBCO JasperReports Library for ActiveMatrix BPM versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO Jaspersoft Studio versions up to and including 6.4.2, update to a version later than 6.4.2. For TIBCO Jaspersoft Studio Community Edition versions up to and including 6.4.3, update to a version later than 6.4.3. For TIBCO Jaspersoft Studio for ActiveMatrix BPM versions up to and including 6.4.2, update to a version later than 6.4.2.

Correção

Identificadores relacionados

CVE-2018-5429

Produtos afetados

Jasperreports Library

Jasperreports Library Community Edition

Tibco Jasperreports Library For Activematrix Bpm

Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Jaspersoft Studio

Jaspersoft Studio Community Edition

Jaspersoft Studio For Activematrix Bpm

Tibco Jaspersoft For Aws With Multi-Tenancy

Referências · 6

• https://ubuntu.com/security/CVE-2018-5429 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-5429 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-5429 · Nota de Segurança
• https://tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5429 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-5429 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5429 · Aviso do Fabricante