PT-2019-19289 · Tibco · Tibco Jasperreports Server For Activematrix Bpm+1

Published 2019-03-07 · Updated 2022-01-01 · CVE-2019-8986

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TIBCO JasperReports Server versions up to and including 6.4.3 TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3

Description The issue allows a malicious authenticated user to copy text files from the host operating system through the SOAP API component.

Recommendations For TIBCO JasperReports Server versions up to and including 6.4.3, update to a version later than 6.4.3 to resolve the issue. For TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3, update to a version later than 6.4.3 to resolve the issue.

Fix

Related Identifiers

CVE-2019-8986

Affected Products

Tibco Jasperreports Server

Tibco Jasperreports Server For Activematrix Bpm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-8986 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8986 · Vendor Advisory
• https://tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986 · Vendor Advisory
• http://tibco.com/services/support/advisories · Vendor Advisory