PT-2019-9638 · Tibco · Tibco Jasperreports Server For Activematrix Bpm+4

Mr_Me + 1 · Publicado 2019-03-06 · Atualizado 2019-10-03 · CVE-2018-18815

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions 6.4.0 through 6.4.3 and 7.1.0 TIBCO JasperReports Server Community Edition versions up to and including 7.1.0 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3 TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 7.1.0 TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 7.1.0

Description The REST API component of the affected software contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface.

Recommendations For TIBCO JasperReports Server versions 6.4.0 through 6.4.3 and 7.1.0, update to a version that includes the fix for this issue. For TIBCO JasperReports Server Community Edition versions up to and including 7.1.0, update to a version that includes the fix for this issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3, update to a version that includes the fix for this issue. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 7.1.0, update to a version that includes the fix for this issue. For TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 7.1.0, update to a version that includes the fix for this issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2018-18815

ZDI-19-256

ZDI-19-305

Produtos afetados

Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Tibco Jaspersoft For Aws With Multi-Tenancy

Referências · 8

• https://osv.dev/vulnerability/CVE-2018-18815 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18815 · Nota de Segurança
• https://tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809 · Aviso do Fabricante
• http://securityfocus.com/bid/107346 · Nota
• http://tibco.com/services/support/advisories · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-305 · Nota de Segurança
• https://tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18815 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-19-256 · Nota de Segurança