ZeroDay Findings
Sign inSign up

Findings

CVE-2018-18809

TIBCO JasperReports Library Directory Traversal Vulnerability

Published Mar 7, 2019 · updated Jun 16, 2026 · tibco jasperreports library

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 7, 2019 · Catalog

    Detected

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics fo

  2. Dec 29, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jan 19, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics fo

Required action

Apply updates per vendor instructions.

CISA due date Jan 19, 2023

Affected

  • cpe tibco/jasperreports libraryversion unspecified
  • cpe tibco/jasperreports library7.1.0
  • cpe tibco/jasperreports library7.2.0
  • cpe tibco/jasperreports serverversion unspecified
  • cpe tibco/jasperreports server7.1.0
  • cpe tibco/jaspersoftversion unspecified
  • vendor TIBCO JasperReportsversion unspecified

Sources

  • CISA KEVCVE-2018-18809

    TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

    cisa.gov
  • CVE.orgCVE-2018-18809

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-18809

    30-day exploitation probability 79.1%

    first.org
  • NIST NVDCVE-2018-18809

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports S

    nvd.nist.gov
  • Packet Storm Securityhttp://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html

    Packet Storm link already published on the finding.

    packetstormsecurity.com

References

CVE-2018-18809 · ZeroDay Findings