The vulnerability of the server-side application library for creating reports from TIBCO JasperReports Library, JasperReports Library for ActiveMatrix BPM, JasperReports Server, JasperReports Server for AWS Marketplace, and JasperReports Server for ActiveMatrix BPM arises from an incorrect limitation on the path to the restricted directory. This allows attackers to disclose sensitive information that should be protected.

🗓️ 01 Mar 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Server side report libraries have an incorrect path limit to restricted directories, enabling data disclosure.

Reporter	Title	Published	Views	Family All 20
0day.today	Tibco JasperSoft Path Traversal Vulnerability	10 Sep 201900:00	–	zdt
IBM Security Bulletins	Security Bulletin: TIBCO JasperReports Vulnerabilities Affect IBM Sterling B2B Integrator (CVE-2020-9410, CVE-2018-18809)	6 Oct 202114:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple JasperReports Vulnerabilities Affect IBM Control Center (CVE-2020-9410, CVE-2018-18809)	16 Jun 202119:25	–	ibm
ATTACKERKB	TIBCO JasperReports Library Directory Traversal Vulnerability	7 Mar 201900:00	–	attackerkb
Circl	CVE-2018-18809	8 Mar 201900:21	–	circl
CISA KEV Catalog	TIBCO JasperReports Library Directory Traversal Vulnerability	29 Dec 202200:00	–	cisa_kev
CNVD	Multiple TIBCO Software Products Path Traversal Vulnerabilities	10 Sep 201900:00	–	cnvd
CVE	CVE-2018-18809	7 Mar 201922:00	–	cve
Cvelist	CVE-2018-18809 TIBCO JasperReports Library Directory Traversal Vulnerability	7 Mar 201922:00	–	cvelist
Dsquare	TIBCO JasperSoft Path Traversal	28 Oct 202000:00	–	dsquare

Vulners

Node

tibco_software jasperreports_libraryMatch7.2.0

OR

tibco_software jasperreports_libraryMatch6.3.4

OR

tibco_software jasperreports_libraryMatch6.4.1

OR

tibco_software jasperreports_libraryMatch6.4.2

OR

tibco_software jasperreports_libraryMatch6.4.21

OR

tibco_software jasperreports_libraryMatch7.1.0

OR

tibco_software jasperreports_libraryMatch6.4.3

OR

tibco_software jasperreports_library_for_activematrix_bpmRange≤6.4.21

OR

tibco_software jasperreports_server_community_editionRange≤6.7.0

OR

tibco_software jasperreports_server_for_activematrix_bpmRange≤6.4.3

OR

tibco_software jasperreports_server_community_editionRange≤6.4.3

OR

tibco_software jaspersoft_reporting_and_analytics_for_awsRange≤7.1.0

OR

tibco_software jaspersoft_for_aws_with_multi-tenancyRange≤7.1.0

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-18809
packetstormsecurity	www.packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html
seclists	www.seclists.org/fulldisclosure/2019/Sep/17
securityfocus	www.securityfocus.com/bid/107351
tibco	www.tibco.com/services/support/advisories
cybersecurityworks	www.cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html
security	www.security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html
tibco	www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

06 Feb 2025 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 36.5

CVSS 26.8

EPSS0.79836

restricted directory path path limitation sensitive information disclosure server side libraries report libraries