CVE-2018-5430: TIBCO JasperReports Server Information Disclosure Vulnerability
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Other sources
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TIBCO JasperReports Server Community Editionto a version that resolves this vulnerability.Fixed in 6.4.3 - Upgrade
Upgrade
TIBCO JasperReports Server for ActiveMatrix BPMto a version that resolves this vulnerability.Fixed in 6.4.3 - Upgrade
Upgrade
TIBCO JasperReports Serverto a version that resolves this vulnerability.Fixed in 6.2.5 - Upgrade
Upgrade
TIBCO JasperReports Serverto a version that resolves this vulnerability.Fixed in 6.3.4 - Upgrade
Upgrade
TIBCO JasperReports Serverto a version that resolves this vulnerability.Fixed in 6.4.3 - Upgrade
Upgrade
TIBCO Jaspersoft Reporting and Analytics for AWSto a version that resolves this vulnerability.Fixed in 6.4.3 - Upgrade
Upgrade
TIBCO Jaspersoft for AWS with Multi-Tenancyto a version that resolves this vulnerability.Fixed in 6.4.3
Event History
Frequently Asked Questions
What is CVE-2018-5430?
CVE-2018-5430 is a vulnerability found in TIBCO JasperReports Server that allows for information disclosure.
What is the severity of CVE-2018-5430?
The severity of CVE-2018-5430 is high, with a CVSS score of 8.8.
Which software versions are affected by CVE-2018-5430?
TIBCO JasperReports Server versions 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, and 6.4.2 are affected by CVE-2018-5430.
How can I fix CVE-2018-5430?
To fix CVE-2018-5430, it is recommended to upgrade TIBCO JasperReports Server to a version that is not affected.
Where can I find more information about CVE-2018-5430?
You can find more information about CVE-2018-5430 at the following references: [https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430](https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430), [https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/](https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/), [https://www.exploit-db.com/exploits/44623/](https://www.exploit-db.com/exploits/44623/)