Lucene search

[email protected]NVD:CVE-2018-5430

HistoryApr 17, 2018 - 6:29 p.m.

CVE-2018-5430

2018-04-1718:29:00

CWE-22

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.059

Percentile

93.5%

JSON

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected configurations

Nvd

Node

tibcojasperreports_serverRange≤6.2.4

tibcojasperreports_serverRange≤6.4.2activematrix_bpm

tibcojasperreports_serverRange≤6.4.2community

tibcojasperreports_serverMatch6.3.0

tibcojasperreports_serverMatch6.3.2

tibcojasperreports_serverMatch6.3.3

tibcojasperreports_serverMatch6.4.0

tibcojasperreports_serverMatch6.4.2

Node

tibcojaspersoftRange≤6.4.2aws_with_multi-tenancy

tibcojaspersoft_reporting_and_analyticsRange≤6.4.2aws

VendorProductVersionCPE
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*
tibcojasperreports_server*cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*
tibcojasperreports_server6.3.0cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*
tibcojasperreports_server6.3.2cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*
tibcojasperreports_server6.3.3cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:*
tibcojasperreports_server6.4.0cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*
tibcojasperreports_server6.4.2cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*
tibcojaspersoft*cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*
tibcojaspersoft_reporting_and_analytics*cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*

Vendor	Product	Version	CPE
tibco	jasperreports_server	*	cpe:2.3:a:tibco:jasperreports_server::::::::
tibco	jasperreports_server	*	cpe:2.3:a:tibco:jasperreports_server::::::activematrix_bpm::*
tibco	jasperreports_server	*	cpe:2.3:a:tibco:jasperreports_server:::::community:::*
tibco	jasperreports_server	6.3.0	cpe:2.3:a:tibco:jasperreports_server:6.3.0:::::::*
tibco	jasperreports_server	6.3.2	cpe:2.3:a:tibco:jasperreports_server:6.3.2:::::::*
tibco	jasperreports_server	6.3.3	cpe:2.3:a:tibco:jasperreports_server:6.3.3:::::::*
tibco	jasperreports_server	6.4.0	cpe:2.3:a:tibco:jasperreports_server:6.4.0:::::::*
tibco	jasperreports_server	6.4.2	cpe:2.3:a:tibco:jasperreports_server:6.4.2:::::::*
tibco	jaspersoft	*	cpe:2.3:a:tibco:jaspersoft::::::aws_with_multi-tenancy::*
tibco	jaspersoft_reporting_and_analytics	*	cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics::::::aws::*