CVE-2018-5430: TIBCO JasperReports Server Information Disclosure Vulnerability
Vulnerability summary
CVE-2018-5430 is a high (CVSS 8.8) Path Traversal vulnerability in TIBCO JasperReports. It is known to be exploited: CISA lists it, first on 29-12-2022. EPSS estimates a 48.05% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 17-04-2018PublishedVulnerability first disclosed.
- 29-12-2022Added to CISA KEVTIBCO JasperReports Server Information Disclosure Vulnerability
- 19-01-2023CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
CVSS metrics
6 scores · 3 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.7HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
48.05%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
-1.58 pp
From 49.63% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 29-12-2022
- Federal due date
- 19-01-2023
CISA required action
Apply updates per vendor instructions. www.tibco.com/support/… nvd.nist.gov/vuln/detail/CVE-2018-5430
Public exploits
2 foundExploit Reference (rhinosecuritylabs.com)
Maturity: unknown
JasperReports - (Authenticated) File Read
Maturity: poc
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Tibco software inc.5 products
- tibco jasperreports server≥ unspecified, ≤ 6.2.4 | 6.3.0 | 6.3.2 | 6.3.3 | 6.4.0 | 6.4.2
- tibco jasperreports server community edition≥ unspecified, ≤ 6.4.2
- tibco jasperreports server for activematrix bpm≥ unspecified, ≤ 6.4.2
- tibco jaspersoft for aws with multi-tenancy≥ unspecified, ≤ 6.4.2
- tibco jaspersoft reporting and analytics for aws≥ unspecified, ≤ 6.4.2
Tibco3 products
- jasperreports_server≤ 6.2.4 | ≤ 6.4.2 | 6.3.0 | 6.3.2 | 6.3.3 | 6.4.0 | 6.4.2
- jaspersoft≤ 6.4.2
- jaspersoft_reporting_and_analytics≤ 6.4.2
Ubuntu1 product
- jasperreportsAll versions (No fix recorded)
3 vendors · 9 products
References
7 links- rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/X Refsource MISCExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430Government ResourceUS Government Resource