10
CVE-2018-18815
- EPSS 0.24%
- Veröffentlicht 07.03.2019 22:29:00
- Zuletzt bearbeitet 21.11.2024 03:56:40
- Quelle security@tibco.com
- CVE-Watchlists
- Unerledigt
LoginTIBCO JasperReports Server User Information Disclosure
The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tibco ≫ Jasperreports Server SwPlatformactivematrix_bpm Version <= 6.4.3
Tibco ≫ Jasperreports Server SwEditioncommunity Version <= 7.1.0
Tibco ≫ Jasperreports Server Version6.4.0
Tibco ≫ Jasperreports Server Version6.4.1
Tibco ≫ Jasperreports Server Version6.4.2
Tibco ≫ Jasperreports Server Version6.4.3
Tibco ≫ Jasperreports Server Version7.1.0
Tibco ≫ Jaspersoft SwPlatformaws_with_multi-tenancy Version <= 7.1.0
Tibco ≫ Jaspersoft Reporting And Analytics SwPlatformaws Version <= 7.1.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.24% | 0.472 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| security@tibco.com | 10 | 3.9 | 6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.