Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2018-18809

TIBCO JasperReports Library Directory Traversal Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TIBCO Software Inc. TIBCO JasperReports Library

  • unspecified to ≤ 6.3.4affected
  • 6.4.1affected
  • 6.4.2affected
  • 6.4.21affected
  • 7.1.0affected
  • 7.2.0affected

TIBCO Software Inc. TIBCO JasperReports Library Community Edition

  • unspecified to ≤ 6.7.0affected

TIBCO Software Inc. TIBCO JasperReports Library for ActiveMatrix BPM

  • unspecified to ≤ 6.4.21affected

TIBCO Software Inc. TIBCO JasperReports Server

  • unspecified to ≤ 6.3.4affected
  • 6.4.0affected
  • 6.4.1affected
  • 6.4.2affected
  • 6.4.3affected
  • 7.1.0affected

TIBCO Software Inc. TIBCO JasperReports Server Community Edition

  • unspecified to ≤ 6.4.3affected
  • 7.1.0affected

TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM

  • unspecified to ≤ 6.4.3affected

TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy

  • unspecified to ≤ 7.1.0affected

TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS

  • unspecified to ≤ 7.1.0affected

References