CVE-2018-5430

Name	CVE-2018-5430
Description	The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jasperreports (PTS)	jessie	4.1.3+dfsg-3	vulnerable
	stretch	6.2.2-3	undetermined
	buster, sid	6.3.1-2	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
jasperreports	source	(unstable)	undetermined	medium
jasperreports	source	jessie	(unfixed)	end-of-life
jasperreports	source	wheezy	(unfixed)	end-of-life

Notes

[jessie] - jasperreports <end-of-life> (not supported in Jessie)
[wheezy] - jasperreports <end-of-life> (not supported in Wheezy)
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430