CVE-2018-5431

Summary

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected Software

VendorProductVersion RangeStatus
TIBCO Software Inc.TIBCO JasperReports Serverunspecified <= 6.2.4affected
TIBCO Software Inc.TIBCO JasperReports Server6.3.0affected
TIBCO Software Inc.TIBCO JasperReports Server6.3.2affected
TIBCO Software Inc.TIBCO JasperReports Server6.3.3affected
TIBCO Software Inc.TIBCO JasperReports Server6.4.0affected
TIBCO Software Inc.TIBCO JasperReports Server6.4.2affected
TIBCO Software Inc.TIBCO JasperReports Server Community Editionunspecified <= 6.4.2affected
TIBCO Software Inc.TIBCO JasperReports Server for ActiveMatrix BPMunspecified <= 6.4.2affected
TIBCO Software Inc.TIBCO Jaspersoft for AWS with Multi-Tenancyunspecified <= 6.4.2affected
TIBCO Software Inc.TIBCO Jaspersoft Reporting and Analytics for AWSunspecified <= 6.4.2affected

Weaknesses

  • The impact includes the theoretical possibility of a user performing operations using another user's access, including administrative functions being performed by a non-administrative user.

ADP Enrichment

CVE Program Container

Additional References

References