CVE-2018-5430

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 48,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada tibco jasperreports server, tibco jaspersoft +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 29 Desember 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Rincian

Terbit di NVD

17 April 2018

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

48,1% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

TIBCO JasperReports Server Information Disclosure Vulnerability

Masuk KEV

29 Desember 2022

Tenggat CISA

19 Januari 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-201... broken link · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430 pemerintah AS
• https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/ exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/44623/ exploit · advisory pihak ketiga · vdb entry