TIBCO JasperReports Library Code Sandboxing Problem
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA.
Summary
A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow analytic reports that contain scripting to perform arbitrary code execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO JasperReports Library: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library Community Edition: versions up to and including 6.4.3, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM: versions up to and including 6.4.2.
Why it matters now
EPSS 0.01525 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO JasperReports Server | up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server Community Edition | up to 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for ActiveMatrix BPM | up to 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library | up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library Community Edition | up to 6.4.3 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library for ActiveMatrix BPM | up to 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft for AWS with Multi-Tenancy | up to 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Reporting and Analytics for AWS | up to 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Studio | up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Studio Community Edition | up to 6.4.3 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Studio for ActiveMatrix BPM | up to 6.4.2 | — | No fix listed | CNA |
- TIBCO JasperReports Server VendorTIBCO Affected up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 Fixed in — No fix listed CNA
- TIBCO JasperReports Server Community Edition VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
- TIBCO JasperReports Library VendorTIBCO Affected up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2 Fixed in — No fix listed CNA
- TIBCO JasperReports Library Community Edition VendorTIBCO Affected up to 6.4.3 Fixed in — No fix listed CNA
- TIBCO JasperReports Library for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
- TIBCO Jaspersoft for AWS with Multi-Tenancy VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Reporting and Analytics for AWS VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Studio VendorTIBCO Affected up to 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Studio Community Edition VendorTIBCO Affected up to 6.4.3 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Studio for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.2 Fixed in — No fix listed CNA
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* | up to 6.2.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* | up to 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* | up to 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:* | 6.3.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:* | 6.3.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:*:*:* | up to 6.2.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:activematrix_bpm:*:* | up to 6.4.2 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* Versions up to 6.2.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:* Versions 6.3.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:* Versions 6.3.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:*:*:* Versions up to 6.2.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:activematrix_bpm:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:* | up to 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.3.2:*:*:*:*:*:*:* | 6.3.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.3.3:*:*:*:*:*:*:* | 6.3.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.4.1:*:*:*:*:*:*:* | 6.4.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* | up to 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* | up to 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:*:*:* | up to 6.2.4 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:activematrix_bpm:*:* | up to 6.4.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:community:*:*:* | up to 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:6.3.0:*:*:*:*:*:*:* | 6.3.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:6.3.2:*:*:*:*:*:*:* | 6.3.2 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:6.3.3:*:*:*:*:*:*:* | 6.3.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:6.4.0:*:*:*:*:*:*:* | 6.4.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_studio:6.4.2:*:*:*:*:*:*:* | 6.4.2 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:* Versions up to 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.3.2:*:*:*:*:*:*:* Versions 6.3.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.3.3:*:*:*:*:*:*:* Versions 6.3.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.4.1:*:*:*:*:*:*:* Versions 6.4.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:*:*:* Versions up to 6.2.4 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:activematrix_bpm:*:* Versions up to 6.4.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:community:*:*:* Versions up to 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:6.3.0:*:*:*:*:*:*:* Versions 6.3.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:6.3.2:*:*:*:*:*:*:* Versions 6.3.2 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:6.3.3:*:*:*:*:*:*:* Versions 6.3.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:6.4.0:*:*:*:*:*:*:* Versions 6.4.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_studio:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2018-5429
- 2026-10-03 Alias added: GHSA-6524-6266-mqf2
References
More TIBCO Jasperreports Library vulnerabilities
- TI-2018-13320 TIBCO JasperReports Library Directory Traversal Vulnerability KEVCVSS 3.1MEDIUM 6.5
- TI-2020-07526 Cross-site scripting in TIBCO JasperReports Library CVSS 3.1HIGH 8.8
- TI-2022-07020 TIBCO JasperReports Library Directory Traversal Vulnerability CVSS 3.1HIGH 8.8
- TI-2017-03547 TIBCO JasperReports persistent cross site scripting CVSS 3.0MEDIUM 5.4
Sources
- CVE-2018-5429 · CVE Program
- CVE-2018-5429 · NVD
- FIRST EPSS
- GHSA-6524-6266-mqf2 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-5429 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences