CVE-2018-5430

KEVTIBCO JasperReports Server Information Disclosure Vulnerability

Description

TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PublishedApr 17, 2018

Last modifiedJun 17, 2026

Added to KEVDec 29, 2022

Remediation dueJan 19, 2023

References

rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/ExploitThird Party Advisory
exploit-db.com/exploits/44623/ExploitThird Party Advisory
tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430Broken LinkVendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1377 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 48.1% · top 1% of all CVEs
Weakness: CWE-22
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.