PT-2019-6316 · Tibco Software · Tibco Jasperreports Library For Activematrix Bpm+7

Elar Lang · Publicado 2019-03-07 · Atualizado 2025-02-12 · CVE-2018-18809

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Library versions up to and including 7.2.0 TIBCO JasperReports Library Community Edition versions up to and including 6.7.0 TIBCO JasperReports Library for ActiveMatrix BPM versions up to and including 6.4.21 TIBCO JasperReports Server versions up to and including 7.1.0 TIBCO JasperReports Server Community Edition versions up to and including 7.1.0 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3 TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 7.1.0 TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 7.1.0

Description The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. This issue is related to incorrect restriction of a pathname to a directory with limited access. Exploitation of this vulnerability may allow a remote attacker to disclose protected information.

Recommendations For TIBCO JasperReports Library versions up to and including 7.2.0, update to a version that includes a fix for this vulnerability. For TIBCO JasperReports Library Community Edition versions up to and including 6.7.0, update to a version that includes a fix for this vulnerability. For TIBCO JasperReports Library for ActiveMatrix BPM versions up to and including 6.4.21, update to a version that includes a fix for this vulnerability. For TIBCO JasperReports Server versions up to and including 7.1.0, update to a version that includes a fix for this vulnerability. For TIBCO JasperReports Server Community Edition versions up to and including 7.1.0, update to a version that includes a fix for this vulnerability. For TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3, update to a version that includes a fix for this vulnerability. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 7.1.0, update to a version that includes a fix for this vulnerability. For TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 7.1.0, update to a version that includes a fix for this vulnerability. As a temporary workaround, consider restricting access to sensitive directories and files on the host system to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-00914

CVE-2018-18809

Produtos afetados

Tibco Jasperreports Library

Jasperreports Library Community Edition

Tibco Jasperreports Library For Activematrix Bpm

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Tibco Jaspersoft For Aws With Multi-Tenancy

Referências · 14

• 🔥 https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html · Exploit
• 🔥 https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html · Exploit
• http://securityfocus.com/bid/107351 · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809 · Nota
• http://tibco.com/services/support/advisories · Aviso do Fabricante
• https://tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809 · Nota de Segurança, Aviso do Fabricante
• http://seclists.org/fulldisclosure/2019/Sep/17 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18809 · Nota de Segurança
• https://t.me/defcon_news/24231 · Publicação no Telegram
• http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html · Nota
• https://t.me/cvenotify/111125 · Publicação no Telegram
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Nota
• https://osv.dev/vulnerability/CVE-2018-18809 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-00914 · Nota de Segurança