CVE-2018-5430 : The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Published 2018-04-17 18:29:00

Updated 2019-10-09 23:41:20

Source TIBCO Software Inc.

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2018-5430

Tibco » Jasperreports Server » Community Edition
Versions up to, including, (<=) 6.4.2
cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*
Matching versions
Tibco » Jasperreports Server
Versions up to, including, (<=) 6.2.4
cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » For Activematrix Bpm
Versions up to, including, (<=) 6.4.2
cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.4.0
cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.3.0
cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.3.2
cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.4.2
cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*
Matching versions
Tibco » Jasperreports Server » Version: 6.3.3
cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:*
Matching versions
Tibco » Jaspersoft » For Aws With Multi-tenancy
Versions up to, including, (<=) 6.4.2
cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*
Matching versions
Tibco » Jaspersoft Reporting And Analytics » For AWS
Versions up to, including, (<=) 6.4.2
cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*
Matching versions

CVE-2018-5430 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

TIBCO JasperReports Server Information Disclosure Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

Notes:

https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430

Added on 2022-12-29 Action due date 2023-01-19

Exploit prediction scoring system (EPSS) score for CVE-2018-5430

EPSS FAQ

5.85%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-5430

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.7	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	3.1	4.0	TIBCO Software Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-5430

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-5430

https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/

Authenticated File Read Vulnerability in JasperReports | (CVE-2018-5430) - Rhino Security Labs
Exploit;Third Party Advisory
https://www.exploit-db.com/exploits/44623/

JasperReports - (Authenticated) File Read
Exploit;VDB Entry;Third Party Advisory
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430

TIBCO Security Advisory: April 17, 2018 - TIBCO JasperReports - 2018-5430 | TIBCO Software
Vendor Advisory