Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2018-5430

Опубликовано: 17 апр. 2018
Источник: nvd
CVSS3: 7.7
CVSS3: 8.8
CVSS2: 4
EPSS Средний

Описание

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*
Версия до 6.2.4 (включая)
cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*
Версия до 6.4.2 (включая)
cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*
Версия до 6.4.2 (включая)
cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*
cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:*
cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*
Версия до 6.4.2 (включая)
cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*
Версия до 6.4.2 (включая)

EPSS

Процентиль: 97%
0.3141
Средний

7.7 High

CVSS3

8.8 High

CVSS3

4 Medium

CVSS2

Дефекты

CWE-22
CWE-200

Связанные уязвимости

ubuntu логотип

CVE-2018-5430

CVSS3: 8.8
ubuntu
почти 8 лет назад

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

debian логотип

CVE-2018-5430

CVSS3: 8.8
debian
почти 8 лет назад

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Serv ...

github логотип

GHSA-782f-h7v4-m7wc

CVSS3: 8.8
github
больше 3 лет назад

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

fstec логотип

BDU:2023-01106

CVSS3: 7.7
fstec
почти 8 лет назад

Уязвимость приложений для создания отчетов TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, и TIBCO Jaspersoft Reporting and Analytics for AWS, существующая из-за неверного ограничения имени пути к каталогу с ограниченным доступом, позволяющая нарушителю раскрыть защищаемую информацию

EPSS

Процентиль: 97%
0.3141
Средний

7.7 High

CVSS3

8.8 High

CVSS3

4 Medium

CVSS2

Дефекты

CWE-22
CWE-200