vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-18815

TIBCO JasperReports Server User Information Disclosure

CRITICAL
10
CVSS Score
Published: March 7, 2019 at 10:00 PM UTC
Updated: June 17, 2026 at 01:47 AM UTC
7 products affected across 1 vendorJasperReports ServerJaspersoft Reporting and AnalyticsJaspersoft

Using TIBCO JasperReports Server by TIBCO Software Inc.?

Get instant alerts when new vulnerabilities affect TIBCO JasperReports Server - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL10
Exploit prediction
EPSS 3%

Description

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

References (5)

VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/107346
x_refsource_MISCVendor Advisory
Source: [email protected]
http://www.tibco.com/services/support/advisories
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18815
x_refsource_MISC
Source: [email protected]
https://www.zerodayinitiative.com/advisories/ZDI-19-305/

CVSS

10CRITICALtibco
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-863

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card