CVE-2018-5430: TIBCO JasperReports Server Information Disclosure Vulnerability
First published: Tue Apr 17 2018(Updated: )
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Credit: security@tibco.com security@tibco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tibco Jasperreports Server | <=6.2.4 | |
| Tibco Jasperreports Server | <=6.4.2 | |
| Tibco Jasperreports Server | <=6.4.2 | |
| Tibco Jasperreports Server | =6.3.0 | |
| Tibco Jasperreports Server | =6.3.2 | |
| Tibco Jasperreports Server | =6.3.3 | |
| Tibco Jasperreports Server | =6.4.0 | |
| Tibco Jasperreports Server | =6.4.2 | |
| Tibco Jaspersoft | <=6.4.2 | |
| Tibco Jaspersoft Reporting And Analytics | <=6.4.2 | |
Remedy
TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO JasperReports Server versions 6.2.4 and below update to version 6.2.5 or higher TIBCO JasperReports Server versions 6.3.0, 6.3.2, and 6.3.3 update to version 6.3.4 or higher TIBCO JasperReports Server versions 6.4.0 and 6.4.2 update to version 6.4.3 or higher TIBCO JasperReports Server Community Edition versions 6.4.2 and below update to version 6.4.3 or higher TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.2 and below update to version 6.4.3 or higher TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.4.2 and below update to version 6.4.3 or higher TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.4.2 and below update to version 6.4.3 or higher
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/
- https://www.exploit-db.com/exploits/44623/
- https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430
- https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430
Frequently Asked Questions
What is CVE-2018-5430?
CVE-2018-5430 is a vulnerability found in TIBCO JasperReports Server that allows for information disclosure.
What is the severity of CVE-2018-5430?
The severity of CVE-2018-5430 is high, with a CVSS score of 8.8.
Which software versions are affected by CVE-2018-5430?
TIBCO JasperReports Server versions 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, and 6.4.2 are affected by CVE-2018-5430.
How can I fix CVE-2018-5430?
To fix CVE-2018-5430, it is recommended to upgrade TIBCO JasperReports Server to a version that is not affected.
Where can I find more information about CVE-2018-5430?
You can find more information about CVE-2018-5430 at the following references: [https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430](https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430), [https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/](https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/), [https://www.exploit-db.com/exploits/44623/](https://www.exploit-db.com/exploits/44623/)
- collector/nvd-index
- agent/type
- agent/description
- agent/softwarecombine
- agent/title
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/tags
- agent/event
- vendor/tibco
- canonical/tibco jasperreports server
- version/tibco jasperreports server/6.2.4
- version/tibco jasperreports server/6.4.2
- version/tibco jasperreports server/6.3.0
- version/tibco jasperreports server/6.3.2
- version/tibco jasperreports server/6.3.3
- version/tibco jasperreports server/6.4.0
- canonical/tibco jaspersoft
- version/tibco jaspersoft/6.4.2
- canonical/tibco jaspersoft reporting and analytics
- version/tibco jaspersoft reporting and analytics/6.4.2
- canonical/tibco jasperreports