Skip to content
OpenAdvisories
High · 7.7 Known exploited Public exploit CVE-2018-5430 EUVD-2018-17200GHSA-782f-h7v4-m7wc

TIBCO JasperReports Server Information Disclosure Vulnerability

Published Apr 17, 2018 · Updated Oct 21, 2025 · Assigned by tibco

Vendor: TIBCO Software Product: TIBCO JasperReports Server Product: TIBCO JasperReports Server - Community Edition Product: TIBCO JasperReports Server for ActiveMatrix BPM Product: TIBCO Jaspersoft for AWS with Multi-Tenancy Product: TIBCO Jaspersoft Reporting and Analytics for AWS Package: jasperreports Ecosystem: Ubuntu

Description

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected products

VendorProductAffectedFixed
TIBCO Software TIBCO JasperReports Server unspecified – ≤ 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.2 —
TIBCO Software TIBCO JasperReports Server Community Edition unspecified – ≤ 6.4.2 —
TIBCO Software TIBCO JasperReports Server for ActiveMatrix BPM unspecified – ≤ 6.4.2 —
TIBCO Software TIBCO Jaspersoft for AWS with Multi-Tenancy unspecified – ≤ 6.4.2 —
TIBCO Software TIBCO Jaspersoft Reporting and Analytics for AWS unspecified – ≤ 6.4.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS jasperreports No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References