TIBCO JasperReports Library Directory Traversal Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO JasperReports Library | up to 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library Community Edition | up to 6.7.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Library for ActiveMatrix BPM | up to 6.4.21 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server | up to 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server Community Edition | up to 6.4.3; 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO JasperReports Server for ActiveMatrix BPM | up to 6.4.3 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft for AWS with Multi-Tenancy | up to 7.1.0 | — | No fix listed | CNA |
| TIBCO | TIBCO Jaspersoft Reporting and Analytics for AWS | up to 7.1.0 | — | No fix listed | CNA |
- TIBCO JasperReports Library VendorTIBCO Affected up to 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Library Community Edition VendorTIBCO Affected up to 6.7.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Library for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.21 Fixed in — No fix listed CNA
- TIBCO JasperReports Server VendorTIBCO Affected up to 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server Community Edition VendorTIBCO Affected up to 6.4.3; 7.1.0 Fixed in — No fix listed CNA
- TIBCO JasperReports Server for ActiveMatrix BPM VendorTIBCO Affected up to 6.4.3 Fixed in — No fix listed CNA
- TIBCO Jaspersoft for AWS with Multi-Tenancy VendorTIBCO Affected up to 7.1.0 Fixed in — No fix listed CNA
- TIBCO Jaspersoft Reporting and Analytics for AWS VendorTIBCO Affected up to 7.1.0 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:activematrix_bpm:*:*:* | up to 6.4.21 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:* | up to 6.7.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_library:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* | up to 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* | up to 6.4.3 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:* | 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* | up to 7.1.0 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* | up to 7.1.0 | Vulnerable | TIBCO |
- cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:activematrix_bpm:*:*:* Versions up to 6.4.21 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:* Versions up to 6.7.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_library:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* Versions up to 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* Versions up to 6.4.3 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:* Versions up to 7.1.0 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* Versions up to 7.1.0 Vulnerable ·TIBCO
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-12-29 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2018-18809
- 2026-10-03 Alias added: GHSA-2qh3-cx4w-cf3x
References
Exploit 2
Advisory 4
- http://www.tibco.com/services/support/advisories
- https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809
- 20190909 CVE-2018-18809 Path traversal in Tibco JasperSoft
- http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html
More TIBCO Jasperreports Library vulnerabilities
- TI-2020-07526 Cross-site scripting in TIBCO JasperReports Library CVSS 3.1HIGH 8.8
- TI-2022-07020 TIBCO JasperReports Library Directory Traversal Vulnerability CVSS 3.1HIGH 8.8
- TI-2018-03943 TIBCO JasperReports Library Code Sandboxing Problem CVSS 3.0HIGH 8.8
- TI-2017-03547 TIBCO JasperReports persistent cross site scripting CVSS 3.0MEDIUM 5.4
Sources
- CVE-2018-18809 · CVE Program
- CVE-2018-18809 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-2qh3-cx4w-cf3x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences