PT-2018-3861 · Tibco+1 · Tibco Jasperreports Server Community Edition+5

Hector Monsegur · Published 2018-04-17 · Updated 2025-02-12 · CVE-2018-5430

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions up to and including 6.4.2 TIBCO JasperReports Server Community Edition versions up to and including 6.4.2 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.2 TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 6.4.2 TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 6.4.2

Description The vulnerability in the Spring web flows of the affected TIBCO products may allow any authenticated user read-only access to the contents of the web application, including key configuration files. This issue exists due to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to disclose protected information.

Recommendations For TIBCO JasperReports Server versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue. For TIBCO JasperReports Server Community Edition versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue. For TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue. For TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 6.4.2, update to a version later than 6.4.2 to resolve the issue.

Exploit

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

BDU:2023-01106

CVE-2018-5430

Affected Products

Spring

Tibco Jasperreports Server

Tibco Jasperreports Server Community Edition

Tibco Jasperreports Server For Activematrix Bpm

Tibco Jaspersoft Reporting/Analytics For Aws

Tibco Jaspersoft For Aws With Multi-Tenancy

References · 16

• 🔥 https://exploit-db.com/exploits/44623 · Exploit
• 🔥 https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5430 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01106 · Security Note
• https://tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-5430 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5430 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5430 · Security Note
• https://tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5430 · Vendor Advisory
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430 · Note
• https://itsec.ru/news/cisa-preduprezhdayet-ob-aktivnoy-expluatazii-ispravlannih-uyazvimostey-jasperreports · Note
• https://t.me/cvenotify/111124 · Telegram Post
• https://t.me/cvenotify/108785 · Telegram Post