CVE-2018-5430

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22CWE-200

Affected software

VendorProductVersions
TIBCO Software Inc.TIBCO JasperReports Server>= unspecified, <= 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2
TIBCO Software Inc.TIBCO JasperReports Server Community Edition>= unspecified, <= 6.4.2
TIBCO Software Inc.TIBCO JasperReports Server for ActiveMatrix BPM>= unspecified, <= 6.4.2
TIBCO Software Inc.TIBCO Jaspersoft for AWS with Multi-Tenancy>= unspecified, <= 6.4.2
TIBCO Software Inc.TIBCO Jaspersoft Reporting and Analytics for AWS>= unspecified, <= 6.4.2

References

Timeline

Published
Apr 17, 2018
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 29, 2022
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-54315.4The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JaspeCVE-2018-54325.4The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - EntCVE-2018-54336.5The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - EnterpCVE-2018-54346.5The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherCVE-2018-54359.8The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire AnCVE-2018-54368.8The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contCVE-2018-54378.8The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire AnCVE-2018-54386.3Philips ISCV application prior to version 2.3.0 has an insufficient session expiration vulnerability where an attacker could reuse the sessiCVE-2018-54399.8A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to exCVE-2018-54409.8A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based COCVE-2018-54417.8An Improper Validation of Integrity Check Value issue was discovered in PHOENIX CONTACT mGuard firmware versions 7.2 to 8.6.0. mGuard deviceCVE-2018-54429.8A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerab
CVE-2018-5430: High severity, CVSS 8.8 | Vulnix