CVE-2018-18816
published 2019-03-07CVE-2018-18816: The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for…
PriorityP426medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
1.23%
65.3th percentile
The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi- Tenancy versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tibco | jasperreports_server | <= 6.3.4 | — |
| tibco | jasperreports_server | <= 6.4.3 | — |
| tibco | jasperreports_server | <= 7.1.0 | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jasperreports_server | — | — |
| tibco | jaspersoft | <= 7.1.0 | — |
| tibco | jaspersoft_reporting_and_analytics | <= 7.1.0 | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | — | — |
| tibco_software_inc | tibco_jasperreports_server | unspecified – 6.3.4 | — |
| tibco_software_inc | tibco_jasperreports_server_community_edition | unspecified – 7.1.0 | — |
| tibco_software_inc | tibco_jasperreports_server_for_activematrix_bpm | unspecified – 6.4.3 | — |
| tibco_software_inc | tibco_jaspersoft_for_aws_with_multi-tenancy | unspecified – 7.1.0 | — |
| tibco_software_inc | tibco_jaspersoft_reporting_and_analytics_for_aws | unspecified – 7.1.0 | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/107348http://www.tibco.com/services/support/advisorieshttps://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-2018-18816http://www.securityfocus.com/bid/107348http://www.tibco.com/services/support/advisorieshttps://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-2018-18816
2019-03-07
Published