ZeroDay Findings
Sign inSign up

Findings

CVE-2018-5430

TIBCO JasperReports Server Information Disclosure Vulnerability

Published Apr 17, 2018 · updated Jun 16, 2026 · tibco jasperreports server

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 17, 2018 · Catalog

    Detected

    The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key

  2. Dec 29, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jan 19, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key

Required action

Apply updates per vendor instructions.

CISA due date Jan 19, 2023

Affected

  • cpe tibco/jasperreports serverversion unspecified
  • cpe tibco/jasperreports server6.3.0
  • cpe tibco/jasperreports server6.3.2
  • cpe tibco/jasperreports server6.3.3
  • cpe tibco/jasperreports server6.4.0
  • cpe tibco/jasperreports server6.4.2
  • cpe tibco/jaspersoftversion unspecified
  • vendor TIBCO JasperReportsversion unspecified

Sources

  • CISA KEVCVE-2018-5430

    TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

    cisa.gov
  • CVE.orgCVE-2018-5430

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-5430

    30-day exploitation probability 48.1%

    first.org
  • Exploit Database44623

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2018-5430

    The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vul

    nvd.nist.gov

References

CVE-2018-5430 · ZeroDay Findings