CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
Published Mar 7, 2019 · updated Jun 16, 2026 · tibco jasperreports library
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Mar 7, 2019 · Catalog
Detected
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics fo
Dec 29, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jan 19, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics fo
Required action
Apply updates per vendor instructions.
CISA due date Jan 19, 2023
Affected
- cpe tibco/jasperreports libraryversion unspecified
- cpe tibco/jasperreports library7.1.0
- cpe tibco/jasperreports library7.2.0
- cpe tibco/jasperreports serverversion unspecified
- cpe tibco/jasperreports server7.1.0
- cpe tibco/jaspersoftversion unspecified
- vendor TIBCO JasperReportsversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2018-18809
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
cisa.gov - CVE.orgVulnerability recordCVE-2018-18809
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2018-18809
30-day exploitation probability 79.1%
first.org - NIST NVDVulnerability recordCVE-2018-18809
The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports S
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html
Packet Storm link already published on the finding.
packetstormsecurity.com