CVE-2018-18815

Summary

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected Software

VendorProductVersion RangeStatus
TIBCO Software Inc.TIBCO JasperReports Server6.4.0affected
TIBCO Software Inc.TIBCO JasperReports Server6.4.1affected
TIBCO Software Inc.TIBCO JasperReports Server6.4.2affected
TIBCO Software Inc.TIBCO JasperReports Server6.4.3affected
TIBCO Software Inc.TIBCO JasperReports Server7.1.0affected
TIBCO Software Inc.TIBCO JasperReports Server Community Editionunspecified <= 7.1.0affected
TIBCO Software Inc.TIBCO JasperReports Server for ActiveMatrix BPMunspecified <= 6.4.3affected
TIBCO Software Inc.TIBCO Jaspersoft for AWS with Multi-Tenancyunspecified <= 7.1.0affected
TIBCO Software Inc.TIBCO Jaspersoft Reporting and Analytics for AWSunspecified <= 7.1.0affected

Weaknesses

  • The impact of this vulnerability includes the theoretical possibility of unauthenticated read access to the contents of the host system, when combined with the vulnerability identified by CVE-2018-18809.

ADP Enrichment

CVE Program Container

Additional References

References