CVE-2018-18815

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
TIBCO Software Inc.TIBCO JasperReports Server6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0
TIBCO Software Inc.TIBCO JasperReports Server Community Edition>= unspecified, <= 7.1.0
TIBCO Software Inc.TIBCO JasperReports Server for ActiveMatrix BPM>= unspecified, <= 6.4.3
TIBCO Software Inc.TIBCO Jaspersoft for AWS with Multi-Tenancy>= unspecified, <= 7.1.0
TIBCO Software Inc.TIBCO Jaspersoft Reporting and Analytics for AWS>= unspecified, <= 7.1.0

References

Timeline

Published
Mar 7, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-188165.4The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperRepoCVE-2018-188177.5The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify regiCVE-2018-188195.3A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SCVE-2018-18824.7In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM SpectruCVE-2018-188208.1A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled, then any maliciouCVE-2018-188229.8Grapixel New Media v2.0 allows SQL Injection via the pages.aspx pageref parameter.CVE-2018-188234.8WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.CVE-2018-188244.8WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.CVE-2018-188256.1Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendCVE-2018-188266.5There exists a heap-based buffer overflow in vc1_decode_p_mb_intfi in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-ofCVE-2018-188276.5There exists a heap-based buffer over-read in ff_vc1_pred_dc in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-of-serviCVE-2018-188286.5There exists a heap-based buffer overflow in vc1_decode_i_block_adv in vc1_block.c in Libav 12.3, which allows attackers to cause a denial-o
CVE-2018-18815: Critical severity, CVSS 9.8 | Vulnix