CVE-2018-5430 TIBCO JasperReports Server Information Disclosure Vulnerability

🗓️ 17 Apr 2018 18:00:00Reported by tibcoType

vulnrichment🔗 github.com👁 5 Views

TIBCO JasperReports Server has a vulnerability allowing information disclosure to authenticated users.

Reporter	Title	Published	Views	Family All 22
zdt	JasperReports - Authenticated File Read Vulnerability	15 May 201800:00	–	zdt
ATTACKERKB	TIBCO JasperReports Server Information Disclosure Vulnerability	17 Apr 201800:00	–	attackerkb
BDU FSTEC	The vulnerability in applications for creating reports using TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS arises due to an incorrect path name limitation in the restricted directory. This allows attackers to disclose sensitive information.	7 Mar 202300:00	–	bdu_fstec
Circl	CVE-2018-5430	14 Jun 202321:10	–	circl
CISA KEV Catalog	TIBCO JasperReports Server Information Disclosure Vulnerability	29 Dec 202200:00	–	cisa_kev
CNVD	Multiple TIBCO Products Spring web flows Component Information Disclosure Vulnerability	19 Apr 201800:00	–	cnvd
CVE	CVE-2018-5430	17 Apr 201818:00	–	cve
Cvelist	CVE-2018-5430 TIBCO JasperReports Server Information Disclosure Vulnerability	17 Apr 201818:00	–	cvelist
Debian CVE	CVE-2018-5430	17 Apr 201818:00	–	debiancve
Exploit DB	JasperReports - (Authenticated) File Read	3 May 201800:00	–	exploitdb

Source	Link
exploit-db	www.exploit-db.com/exploits/44623/
tibco	www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430
rhinosecuritylabs	www.rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/

16 May 2018 09:57Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.7

EPSS0.4963

SSVC

tibco jasperreports server information disclosure authenticated user access vulnerable versions