CVE-2018-18815
published 2019-03-07CVE-2018-18815: The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for…
PriorityP260critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
3.13%
86.3th percentile
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tibco | jasperreports_server | <= 6.4.3 | — |
| tibco | jasperreports_server | <= 7.1.0 | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jaspersoft | <= 7.1.0 | — |
| tibco | jaspersoft_reporting_and_analytics | <= 7.1.0 | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server_community_edition | unspecified – 7.1.0 | — |
| tibco_software_inc | tibco_jasperreports_server_for_activematrix_bpm | unspecified – 6.4.3 | — |
| tibco_software_inc | tibco_jaspersoft_for_aws_with_multi-tenancy | unspecified – 7.1.0 | — |
| tibco_software_inc | tibco_jaspersoft_reporting_and_analytics_for_aws | unspecified – 7.1.0 | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/107346http://www.tibco.com/services/support/advisorieshttps://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18815https://www.zerodayinitiative.com/advisories/ZDI-19-305/http://www.securityfocus.com/bid/107346http://www.tibco.com/services/support/advisorieshttps://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18815https://www.zerodayinitiative.com/advisories/ZDI-19-305/
2019-03-07
Published