The vulnerability in applications for creating reports using TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS arises due to an incorrect path name limitation in the restricted directory. This allows attackers to disclose sensitive information.

🗓️ 07 Mar 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 9 Views

Vulnerability in TIBCO JasperReports products due to path name limit in restricted directory enables disclosure of sensitive information.

Reporter	Title	Published	Views	Family All 22
zdt	JasperReports - Authenticated File Read Vulnerability	15 May 201800:00	–	zdt
ATTACKERKB	TIBCO JasperReports Server Information Disclosure Vulnerability	17 Apr 201800:00	–	attackerkb
Circl	CVE-2018-5430	14 Jun 202321:10	–	circl
CISA KEV Catalog	TIBCO JasperReports Server Information Disclosure Vulnerability	29 Dec 202200:00	–	cisa_kev
CNVD	Multiple TIBCO Products Spring web flows Component Information Disclosure Vulnerability	19 Apr 201800:00	–	cnvd
CVE	CVE-2018-5430	17 Apr 201818:00	–	cve
Cvelist	CVE-2018-5430 TIBCO JasperReports Server Information Disclosure Vulnerability	17 Apr 201818:00	–	cvelist
Debian CVE	CVE-2018-5430	17 Apr 201818:00	–	debiancve
Exploit DB	JasperReports - (Authenticated) File Read	3 May 201800:00	–	exploitdb
NVD	CVE-2018-5430	17 Apr 201818:29	–	nvd

Vulners

Node

OR

tibco_software jasperreports_serverRange≤6.2.4

tibco_software jasperreports_serverMatch6.3.0

tibco_software jasperreports_serverMatch6.3.2

tibco_software jasperreports_serverMatch6.3.3

tibco_software jasperreports_serverMatch6.4.0

tibco_software jasperreports_serverMatch6.4.2

tibco_software jasperreports_server_community_editionRange≤6.4.2

tibco_software jasperreports_server_for_activematrix_bpmRange≤6.4.2

tibco_software jaspersoft_for_aws_with_multi-tenancyRange≤6.4.2

tibco_software jaspersoft_reporting_and_analytics_for_awsRange≤6.4.2

Source	Link
itsec	www.itsec.ru/news/cisa-preduprezhdayet-ob-aktivnoy-expluatazii-ispravlannih-uyazvimostey-jasperreports
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 26.8

CVSS 37.7

EPSS0.48753

JasperReports Server Path name restriction Sensitive information disclosure Multi Tenancy Amazon Web Services