CVE-2018-18815 TIBCO JasperReports Server User Information Disclosure
Unauthenticated attackers can bypass authorization checks in the REST API to access sensitive user information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18815?
CVE-2018-18815 is a critical missing authorization vulnerability in TIBCO JasperReports Server, published on 7 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Weakness: CWE-863
Which versions are affected by CVE-2018-18815?
It affects 3 products.
Products include Tibco Jasperreports Server, Tibco Jaspersoft, Tibco Jaspersoft Reporting and Analytics.
How do I fix CVE-2018-18815?
No fix has been published for CVE-2018-18815 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-18815 being exploited?
There is no known exploitation of CVE-2018-18815 in the wild and no public exploit code.
Other vulnerabilities in TIBCO JasperReports Server
- CVE-2018-5430 TIBCO JasperReports Server Information Disclosure
- CVE-2017-5533 TIBCO JasperReports Server credentials disclosure
- CVE-2022-41561 TIBCO JasperReports Server RCE Vulnerability
- CVE-2022-41563 TIBCO JasperReports Server Stored XSS Vulnerability
- CVE-2021-35495 TIBCO JasperReports FTP Password exposed
Sources
Also known as GHSA-x2m2-4jfp-mm86.