NVD Vulnerability Detail

CVE-2018-18809

Summary	The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Publication Date	March 8, 2019, 7:29 a.m.
Registration Date	March 1, 2021, 7:11 p.m.
Last Update	Nov. 21, 2024, 12:56 p.m.

CVSS3.1 : MEDIUM
スコア	6.5
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
Score	4.0
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	単一
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:tibco:jasperreports_server:6.4.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.1:::::::*
cpe:2.3:a:tibco:jasperreports_server:6.4.2:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.2:::::::*
cpe:2.3:a:tibco:jasperreports_server::::::activematrix_bpm::*		6.4.3
cpe:2.3:a:tibco:jasperreports_server:6.4.1:::::::*
cpe:2.3:a:tibco:jasperreports_server:6.4.3:::::::*
cpe:2.3:a:tibco:jasperreports_server:7.1.0:::::::*
cpe:2.3:a:tibco:jasperreports_server:7.1.0::::community:::
cpe:2.3:a:tibco:jasperreports_server:6.3.4:::::::*
cpe:2.3:a:tibco:jasperreports_server:::::community:::*		6.4.3
cpe:2.3:a:tibco:jasperreports_library:::::community:::*		6.7.0
cpe:2.3:a:tibco:jasperreports_library:6.3.4:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.21:::::::*
cpe:2.3:a:tibco:jasperreports_library:7.1.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:7.2.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:::::activematrix_bpm:::*		6.4.21

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics::::::aws::*		7.1.0
cpe:2.3:a:tibco:jaspersoft::::::aws_with_multi-tenancy::*		7.1.0

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html	Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html	Third Party Advisory VDB Entry
3	http://seclists.org/fulldisclosure/2019/Sep/17	Mailing List Third Party Advisory
4	http://seclists.org/fulldisclosure/2019/Sep/17	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/107351	Broken Link Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/107351	Broken Link Third Party Advisory VDB Entry
7	http://www.tibco.com/services/support/advisories	Vendor Advisory
8	http://www.tibco.com/services/support/advisories	Vendor Advisory
9	https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html	Exploit Third Party Advisory
10	https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html	Exploit Third Party Advisory
11	https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html	Exploit Third Party Advisory
12	https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html	Exploit Third Party Advisory
13	https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809	Vendor Advisory
14	https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

複数の TIBCO JasperReports および Jaspersoft 製品におけるパストラバーサルの脆弱性

Title	複数の TIBCO JasperReports および Jaspersoft 製品におけるパストラバーサルの脆弱性
Summary	複数の TIBCO JasperReports および Jaspersoft 製品には、パストラバーサルの脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 29, 2018, midnight
Registration Date	April 8, 2019, 4:28 p.m.
Last Update	April 8, 2019, 4:28 p.m.

Affected System

TIBCO Software

TIBCO JasperReports Library

TIBCO JasperReports Library Community Edition

TIBCO JasperReports Library for ActiveMatrix BPM

TIBCO JasperReports Server

TIBCO JasperReports Server Community Edition

TIBCO JasperReports Server for ActiveMatrix BPM

TIBCO Jaspersoft for AWS with Multi-Tenancy

TIBCO Jaspersoft Reporting and Analytics for AWS

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-18809	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18809
2	CVE-2018-18809	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18809
National Vulnerability Database (NVD)
3	CVE-2018-18809	https://nvd.nist.gov/vuln/detail/CVE-2018-18809
4	CVE-2018-18809	https://nvd.nist.gov/vuln/detail/CVE-2018-18809

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html
2	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
TIBCO
1	Security Advisories	http://www.tibco.com/services/support/advisories
2	Security Advisories	http://www.tibco.com/services/support/advisories
TIBCO Security Advisory
3	March 6, 2019 - TIBCO JasperReports Library - 2018-18809	https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809
4	March 6, 2019 - TIBCO JasperReports Library - 2018-18809	https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809

Change Log

No	Changed Details	Date of change
1	[2019年04月08日] 掲載	April 8, 2019, 4:28 p.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:tibco:jasperreports_server:6.4.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.1:::::::*
cpe:2.3:a:tibco:jasperreports_server:6.4.2:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.2:::::::*
cpe:2.3:a:tibco:jasperreports_server::::::activematrix_bpm::*		6.4.3
cpe:2.3:a:tibco:jasperreports_server:6.4.1:::::::*
cpe:2.3:a:tibco:jasperreports_server:6.4.3:::::::*
cpe:2.3:a:tibco:jasperreports_server:7.1.0:::::::*
cpe:2.3:a:tibco:jasperreports_server:7.1.0::::community:::
cpe:2.3:a:tibco:jasperreports_server:6.3.4:::::::*
cpe:2.3:a:tibco:jasperreports_server:::::community:::*		6.4.3
cpe:2.3:a:tibco:jasperreports_library:::::community:::*		6.7.0
cpe:2.3:a:tibco:jasperreports_library:6.3.4:::::::*
cpe:2.3:a:tibco:jasperreports_library:6.4.21:::::::*
cpe:2.3:a:tibco:jasperreports_library:7.1.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:7.2.0:::::::*
cpe:2.3:a:tibco:jasperreports_library:::::activematrix_bpm:::*		6.4.21