Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2018-5431

TIBCO JasperReports Server Cross Site Scripting Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TIBCO Software Inc. TIBCO JasperReports Server

  • unspecified to ≤ 6.2.4affected
  • 6.3.0affected
  • 6.3.2affected
  • 6.3.3affected
  • 6.4.0affected
  • 6.4.2affected

TIBCO Software Inc. TIBCO JasperReports Server Community Edition

  • unspecified to ≤ 6.4.2affected

TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM

  • unspecified to ≤ 6.4.2affected

TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy

  • unspecified to ≤ 6.4.2affected

TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS

  • unspecified to ≤ 6.4.2affected

References