CVE-2018-18809

Katalog CVE

CVSS 6.5 · Medium KEV · sudah dieksploitasi EPSS 79,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada tibco jasperreports library, tibco jasperreports server +2 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD. Masuk katalog KEV CISA pada 29 Desember 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Rincian

Terbit di NVD

7 Maret 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

79,1% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

TIBCO JasperReports Library Directory Traversal Vulnerability

Masuk KEV

29 Desember 2022

Tenggat CISA

19 Januari 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.tibco.com/services/support/advisories advisory vendor
• https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-libr... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809 pemerintah AS
• http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2019/Sep/17 mailing list · advisory pihak ketiga
• http://www.securityfocus.com/bid/107351 broken link · advisory pihak ketiga · vdb entry
• https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html exploit · advisory pihak ketiga
• https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html exploit · advisory pihak ketiga