Lucene search

[email protected]NVD:CVE-2018-18809

HistoryMar 07, 2019 - 10:29 p.m.

CVE-2018-18809

2019-03-0722:29:00

CWE-22

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

0.53

Percentile

97.6%

JSON

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected configurations

Nvd

Node

tibcojasperreports_libraryRange≤6.4.21activematrix_bpm

tibcojasperreports_libraryRange≤6.7.0community

tibcojasperreports_libraryMatch6.3.4

tibcojasperreports_libraryMatch6.4.1

tibcojasperreports_libraryMatch6.4.2

tibcojasperreports_libraryMatch6.4.21

tibcojasperreports_libraryMatch7.1.0

tibcojasperreports_libraryMatch7.2.0

tibcojasperreports_serverRange≤6.4.3activematrix_bpm

tibcojasperreports_serverRange≤6.4.3community

tibcojasperreports_serverMatch6.3.4

tibcojasperreports_serverMatch6.4.0

tibcojasperreports_serverMatch6.4.1

tibcojasperreports_serverMatch6.4.2

tibcojasperreports_serverMatch6.4.3

tibcojasperreports_serverMatch7.1.0

tibcojasperreports_serverMatch7.1.0community

Node

tibcojaspersoftRange≤7.1.0aws_with_multi-tenancy

tibcojaspersoft_reporting_and_analyticsRange≤7.1.0aws

VendorProductVersionCPE
tibcojasperreports_library*cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:activematrix_bpm:*:*:*
tibcojasperreports_library*cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:*
tibcojasperreports_library6.3.4cpe:2.3:a:tibco:jasperreports_library:6.3.4:*:*:*:*:*:*:*
tibcojasperreports_library6.4.1cpe:2.3:a:tibco:jasperreports_library:6.4.1:*:*:*:*:*:*:*
tibcojasperreports_library6.4.2cpe:2.3:a:tibco:jasperreports_library:6.4.2:*:*:*:*:*:*:*
tibcojasperreports_library6.4.21cpe:2.3:a:tibco:jasperreports_library:6.4.21:*:*:*:*:*:*:*
tibcojasperreports_library7.1.0cpe:2.3:a:tibco:jasperreports_library:7.1.0:*:*:*:*:*:*:*
tibcojasperreports_library7.2.0cpe:2.3:a:tibco:jasperreports_library:7.2.0:*:*:*:*:*:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
tibco	jasperreports_library	*	cpe:2.3:a:tibco:jasperreports_library:::::activematrix_bpm:::*
tibco	jasperreports_library	*	cpe:2.3:a:tibco:jasperreports_library:::::community:::*
tibco	jasperreports_library	6.3.4	cpe:2.3:a:tibco:jasperreports_library:6.3.4:::::::*
tibco	jasperreports_library	6.4.1	cpe:2.3:a:tibco:jasperreports_library:6.4.1:::::::*
tibco	jasperreports_library	6.4.2	cpe:2.3:a:tibco:jasperreports_library:6.4.2:::::::*
tibco	jasperreports_library	6.4.21	cpe:2.3:a:tibco:jasperreports_library:6.4.21:::::::*
tibco	jasperreports_library	7.1.0	cpe:2.3:a:tibco:jasperreports_library:7.1.0:::::::*
tibco	jasperreports_library	7.2.0	cpe:2.3:a:tibco:jasperreports_library:7.2.0:::::::*
tibco	jasperreports_server	*	cpe:2.3:a:tibco:jasperreports_server::::::activematrix_bpm::*
tibco	jasperreports_server	*	cpe:2.3:a:tibco:jasperreports_server:::::community:::*