CVE-2018-5430TIBCO JasperReports Server Information Disclosure Vulnerability
Updated under an hour ago ()
Does this affect you?
It affects TIBCO Software Inc. TIBCO JasperReports Server and 7 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Dec 29, 2022; federal agencies had to remediate by Jan 19, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
- CVSS
- 7.7 HIGH (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-200
- Known exploited
- Added to CISA KEV Dec 29, 2022; federal remediation due Jan 19, 2023Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 48.05% (percentile 99)
- Assigned by
- tibco
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
TIBCO Software Inc. TIBCO JasperReports Server tibco_software:tibco_jasperreports_server (from the name) | from unspecified through 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 | CNA record |
TIBCO Software Inc. TIBCO JasperReports Server Community Edition tibco_software:tibco_jasperreports_server_community_edition (from the name) | from unspecified through 6.4.2 | CNA record |
TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM tibco_software:tibco_jasperreports_server_for_activematrix_bpm (from the name) | from unspecified through 6.4.2 | CNA record |
TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy tibco_software:tibco_jaspersoft_for_aws_with_multi_tenancy (from the name) | from unspecified through 6.4.2 | CNA record |
TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS tibco_software:tibco_jaspersoft_reporting_and_analytics_for_aws (from the name) | from unspecified through 6.4.2 | CNA record |
tibco jasperreports_server tibco:jasperreports_server | through 6.2.4; through 6.4.2; through 6.4.2; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 | NVD |
tibco jaspersoft tibco:jaspersoft | through 6.4.2 | NVD |
tibco jaspersoft_reporting_and_analytics tibco:jaspersoft_reporting_and_analytics | through 6.4.2 | NVD |
References
- https://www.exploit-db.com/exploits/44623/exploit, x-refsource-exploit-db, third-party-advisory, vdb-entry
- https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/x-refsource-misc, exploit, third-party-advisory
- https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430x-refsource-confirm, broken-link, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.