CVE-2018-18809
TIBCO JasperReports Library Directory Traversal Vulnerability
Description
CVE-2018-18809 is a medium-severity directory traversal vulnerability in the default server implementation of multiple TIBCO JasperReports products, including JasperReports Library and JasperReports Server. The path traversal flaw (CWE-22) allows authenticated web server users to access contents of the host file system beyond the intended application directories. Affected products span a broad range of TIBCO JasperReports offerings including JasperReports Library, JasperReports Server, their Community Edition and ActiveMatrix BPM variants, as well as Jaspersoft for AWS with Multi-Tenancy and Jaspersoft Reporting and Analytics for AWS. Despite its medium CVSS rating of 6.5, the EPSS score of 93.9% (99.87th percentile) and CISA's inclusion in the Known Exploited Vulnerabilities catalog indicate that CVE-2018-18809 is heavily exploited in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| tibco | jasperreports library | <= 6.4.21; <= 6.7.0; 7.1.0; 7.2.0 |
| tibco | jasperreports server | <= 6.4.3; 7.1.0 |
| tibco | jaspersoft | <= 7.1.0 |
| tibco | jaspersoft reporting and analytics | <= 7.1.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/154406/Tibco-JasperSoft-Path-Traversal.html(Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2019/Sep/17(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/107351(Broken Link, Third Party Advisory, VDB Entry)
- http://www.tibco.com/services/support/advisories(Vendor Advisory)
- https://cybersecurityworks.com/zerodays/cve-2018-18809-tibco.html(Exploit, Third Party Advisory)
- https://security.elarlang.eu/cve-2018-18809-path-traversal-in-tibco-jaspersoft.html(Exploit, Third Party Advisory)
- https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-18809(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a weakness where an application constructs file paths from user-supplied input without adequately restricting access to directories outside the intended scope. In the TIBCO JasperReports default server implementation, this path traversal vulnerability allows authenticated users to craft requests that escape the web application's root directory and read arbitrary files on the host system, potentially exposing sensitive configuration data, credentials, and internal system information.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2018-18809 carries a CVSS v3.1 score of 6.5 (Medium), but its real-world impact is significantly elevated by active exploitation. The vulnerability is remotely exploitable over the network (AV:N), requiring no physical access to the target server. Attack complexity is low (AC:L), meaning the directory traversal can be performed through simple HTTP request manipulation. Low-level authenticated access is required (PR:L), so any valid user account on the JasperReports server can be used to exploit the flaw. No user interaction is needed (UI:N), enabling automated and silent exploitation. Confidentiality impact is high (C:H), as successful exploitation grants read access to sensitive files on the host system, including configuration files, database credentials, and potentially encryption keys. Integrity and availability impacts are none (I:N/A:N), as the vulnerability only enables file reading, not modification or disruption. Despite the medium CVSS score, the EPSS score of 93.9% (99.87th percentile) places CVE-2018-18809 among the most actively exploited vulnerabilities, warranting urgent remediation.
Exploit Maturity
Public exploit code is available for CVE-2018-18809 from multiple sources, including CyberSecurityWorks and a detailed technical analysis on security.elarlang.eu. CISA has confirmed active exploitation of this vulnerability in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 19, 2023. The EPSS score of 93.9% (99.87th percentile) indicates near-certain ongoing exploitation activity, making this one of the most heavily targeted vulnerabilities in TIBCO JasperReports products. The combination of public exploit availability, low exploitation complexity, and confirmed wild exploitation makes immediate patching essential.
Remediation
- Apply TIBCO security patches immediately. Upgrade all affected TIBCO JasperReports products to patched versions as specified in TIBCO's security advisory (March 6, 2019). Affected versions include JasperReports Library up to 6.3.4, 6.4.1, 6.4.2, 6.4.21, 7.1.0, 7.2.0; JasperReports Server up to 6.3.4, 6.4.0-6.4.3, 7.1.0; and related product variants. Apply mitigations per vendor instructions or discontinue use if mitigations are unavailable.
- Restrict network access to JasperReports interfaces. Place JasperReports Server and Library web interfaces behind a VPN, reverse proxy, or firewall. Limit access to authorized users and trusted IP ranges only, reducing the attack surface for authenticated exploitation.
- Deploy WAF rules to block path traversal attempts. Configure a Web Application Firewall to detect and block HTTP requests containing directory traversal sequences (../, .., and URL-encoded variants such as %2e%2e%2f) targeting JasperReports endpoints.
- Review logs for indicators of exploitation. Examine web server access logs for requests containing path traversal patterns directed at JasperReports Server endpoints. Look for access to files outside the application directory, particularly configuration files, /etc/passwd, or other sensitive system files.
- Rotate credentials and review exposed data. Since the vulnerability enables arbitrary file read access, assume that any credentials, API keys, database passwords, or configuration data stored on the host system may have been compromised. Rotate all such secrets and audit access logs for signs of lateral movement using exposed credentials.
Technical Details
CVE-2018-18809 is a directory traversal vulnerability (CWE-22) in the default server implementation of TIBCO JasperReports Library and JasperReports Server. The flaw allows authenticated users to manipulate file path parameters in HTTP requests to navigate outside the web application's intended directory structure and read arbitrary files on the host operating system. The network-based attack vector (AV:N) means exploitation requires only HTTP access to the JasperReports web interface. Low attack complexity (AC:L) indicates that standard path traversal techniques (using sequences like ../) are sufficient without requiring special conditions. The requirement for low privileges (PR:L) means any authenticated user account — even one with minimal permissions — can exploit the vulnerability. The scope is unchanged (S:U) and impact is limited to high confidentiality (C:H) with no integrity or availability impact (I:N/A:N), confirming this is strictly an information disclosure vulnerability through file reading. The vulnerability affects both JasperReports Library (the reporting engine component) and JasperReports Server (the web application), spanning numerous product variants and version lines from TIBCO.
Frequently Asked Questions
Is CVE-2018-18809 being actively exploited?
Yes, CVE-2018-18809 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 19, 2023. The EPSS score of 93.9% (99.87th percentile) indicates near-certain exploitation activity, and public exploit code is readily available from multiple sources.
What products are affected by CVE-2018-18809?
CVE-2018-18809 affects a wide range of TIBCO products: JasperReports Library (up to 6.3.4, 6.4.1, 6.4.2, 6.4.21, 7.1.0, 7.2.0), JasperReports Library Community Edition (up to 6.7.0), JasperReports Library for ActiveMatrix BPM (up to 6.4.21), JasperReports Server (up to 6.3.4, 6.4.0-6.4.3, 7.1.0), JasperReports Server Community Edition (up to 6.4.3, 7.1.0), JasperReports Server for ActiveMatrix BPM (up to 6.4.3), Jaspersoft for AWS with Multi-Tenancy (up to 7.1.0), and Jaspersoft Reporting and Analytics for AWS (up to 7.1.0).
How do I fix CVE-2018-18809?
Upgrade all affected TIBCO JasperReports products to patched versions as specified in TIBCO's March 2019 security advisory. Additionally, restrict network access to JasperReports interfaces, deploy WAF rules to block path traversal sequences, and rotate any credentials stored on the host system. See the Remediation section for complete guidance.
How severe is CVE-2018-18809?
CVE-2018-18809 is rated Medium severity with a CVSS v3.1 score of 6.5 out of 10. However, its real-world severity is considerably higher due to the EPSS score of 93.9% (99.87th percentile) indicating near-certain exploitation. While it only enables file reading (no modification or disruption), the ability to access sensitive host files including credentials and configuration data can facilitate further attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.