Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2019-8986

TIBCO JasperReports Server XML Entity Expansion Vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
tibco

Description

The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TIBCO Software Inc. TIBCO JasperReports Server

  • unspecified to ≤ 6.3.4affected
  • 6.4.0affected
  • 6.4.1affected
  • 6.4.2affected
  • 6.4.3affected

TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM

  • unspecified to ≤ 6.4.3affected

References