cbcvebase.
CVE-2018-18808
published 2019-03-07

CVE-2018-18808: The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server…

PriorityP346high7.5CVSS 3.0
AVNACHPRLUINSUCHIHAH
EPSS
1.70%
74.4th percentile
The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected

20 ranges
VendorProductVersion rangeFixed in
tibcojasperreports_server<= 6.3.4—
tibcojasperreports_server<= 6.4.3—
tibcojasperreports_server<= 7.1.0—
tibcojasperreports_server——
tibcojasperreports_server——
tibcojasperreports_server——
tibcojasperreports_server——
tibcojasperreports_server——
tibcojaspersoft<= 7.1.0—
tibcojaspersoft_reporting_and_analytics<= 7.1.0—
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_server——
tibco_software_inctibco_jasperreports_serverunspecified – 6.3.4—
tibco_software_inctibco_jasperreports_server_community_editionunspecified – 7.1.0—
tibco_software_inctibco_jasperreports_server_for_activematrix_bpmunspecified – 6.4.3—
tibco_software_inctibco_jaspersoft_for_aws_with_multi-tenancyunspecified – 7.1.0—
tibco_software_inctibco_jaspersoft_reporting_and_analytics_for_awsunspecified – 7.1.0—

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.