Skip to content
Fencer Vulns
high 7.7

CVE-2018-5430 kev in the critical feed json

TIBCO JasperReports Server Information Disclosure Vulnerability

published 2018-04-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-17200

cvss
7.7
version 3.0, CNA
cisa kev
Exploited
added 2022-12-29
epss
48.1%
EPSS 48.1% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Patch / fix

cisa required action Apply updates per vendor instructions.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-5430 updated cvss 4.3

jasperreports: read-only access to the contents of the web application for authenticated user

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. First public exploit (EDB-44623)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-01-19 (3 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
TIBCO, JasperReports
CISA name
TIBCO JasperReports Server Information Disclosure Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

48.05% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-44623 JasperReports - (Authenticated) File Read webapps, 2018-05-03
  • rhinosecuritylabs.com https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

  • TIBCO Software Inc. TIBCO JasperReports Server
  • TIBCO Software Inc. TIBCO JasperReports Server Community Edition
  • TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM
  • TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy
  • TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.