Medium severity · published Mar 7, 2019
CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
In wildKEV
6.5
CVSS
79.1%
EPSS
Yes
On KEV
Description
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)79.1% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Dec 29, 2022
Federal remediation dueJan 19, 2023
Ransomware campaign useNot known
Affected products
Which versions
TJ
TIBCO JasperReports Library · TIBCO Software Inc.
through 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0 · source: vendor
TJ
TIBCO JasperReports Library Community Edition · TIBCO Software Inc.
through 6.7.0 · source: vendor
TJ
TIBCO JasperReports Library for ActiveMatrix BPM · TIBCO Software Inc.
through 6.4.21 · source: vendor
TJ
TIBCO JasperReports Server · TIBCO Software Inc.
through 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0 · source: vendor
TJ
TIBCO JasperReports Server Community Edition · TIBCO Software Inc.
through 6.4.3; 7.1.0 · source: vendor
TJ
TIBCO JasperReports Server for ActiveMatrix BPM · TIBCO Software Inc.
through 6.4.3 · source: vendor
TJ
TIBCO Jaspersoft Reporting and Analytics for AWS · TIBCO Software Inc.
through 7.1.0 · source: vendor
TJ
TIBCO Jaspersoft for AWS with Multi-Tenancy · TIBCO Software Inc.
through 7.1.0 · source: vendor
JL
Jasperreports Library · Tibco
through 6.4.21; through 6.7.0; 7.1.0; 7.2.0 · source: NVD
JS
Jasperreports Server · Tibco
through 6.4.3; through 6.4.3; 7.1.0 · source: NVD
JA
Jaspersoft · Tibco
through 7.1.0 · source: NVD
JR
Jaspersoft Reporting And Analytics · Tibco
through 7.1.0 · source: NVD
Affected product
TJ
TIBCO JasperReports Library
TIBCO Software Inc.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-18809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-18809
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
http://www.tibco.com/services/support/advisories
x_refsource_CONFIRM
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809
vdb-entry
http://www.securityfocus.com/bid/107351
mailing-list
http://seclists.org/fulldisclosure/2019/Sep/17
x_refsource_MISC
http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html
x_refsource_MISC
https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html