CVE-2018-5430
TIBCO JasperReports Server Information Disclosure Vulnerability
Description
CVE-2018-5430 is a high-severity vulnerability in TIBCO JasperReports Server that combines path traversal (CWE-22) and information exposure (CWE-200) weaknesses, allowing any authenticated user to gain read-only access to files on the web application's host system, including sensitive configuration files. The vulnerability exists in the Spring web flows of multiple TIBCO JasperReports products, including JasperReports Server, JasperReports Server Community Edition, JasperReports Server for ActiveMatrix BPM, Jaspersoft for AWS with Multi-Tenancy, and Jaspersoft Reporting and Analytics for AWS. With an EPSS score of 41.4% (97.32nd percentile) and confirmed active exploitation tracked by CISA, CVE-2018-5430 poses a significant risk to organizations using unpatched TIBCO JasperReports installations.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| tibco | jasperreports server | <= 6.2.4; <= 6.4.2; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2 |
| tibco | jaspersoft | <= 6.4.2 |
| tibco | jaspersoft reporting and analytics | <= 6.4.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
References
- https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/44623/(Exploit, Third Party Advisory, VDB Entry)
- https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-22 describes a vulnerability where an application uses user-supplied input to construct file paths without properly restricting the path to intended directories. In TIBCO JasperReports Server, the Spring web flows accept user input that can be manipulated to traverse directory boundaries and access files outside the application's intended scope, enabling unauthorized read access to sensitive system files and configuration data.
Learn more: CWE-22 — Path Traversal
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-200 describes a weakness where an application exposes sensitive information to actors who are not authorized to access it. In this case, the path traversal vulnerability in TIBCO JasperReports Server enables authenticated users to read configuration files and other sensitive data from the host system that they should not have access to, exposing credentials, internal paths, and system configuration details.
Learn more: CWE-200 — Exposure of Sensitive Information
Impact Analysis
CVE-2018-5430 carries a CVSS v3.1 score of 8.8 (High), indicating a serious threat to affected TIBCO JasperReports installations. The vulnerability is remotely exploitable over the network (AV:N), allowing attacks from anywhere without physical access. Attack complexity is low (AC:L), meaning exploitation requires no special conditions or preparation. While low-level authenticated access is required (PR:L), any valid JasperReports user account suffices to exploit the flaw. No user interaction is needed (UI:N), enabling silent exploitation by any authenticated user. Confidentiality, integrity, and availability impacts are all rated high (C:H/I:H/A:H), reflecting the potential for attackers to access sensitive configuration files containing database credentials, API keys, and internal system paths that could be leveraged for further compromise. The EPSS score of 41.4% (97.32nd percentile) indicates a substantial probability of exploitation, and CISA's inclusion of this vulnerability in the KEV catalog confirms it has been actively exploited.
Exploit Maturity
Public exploit code is available for CVE-2018-5430 via Exploit-DB and a detailed technical writeup from Rhino Security Labs. CISA has confirmed active exploitation of this vulnerability in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 19, 2023. The EPSS score of 41.4% (97.32nd percentile) indicates a high probability of ongoing exploitation activity. The availability of well-documented public exploits combined with the relatively low barrier to exploitation (any authenticated user can trigger the vulnerability) makes this a high-priority patching target for organizations running TIBCO JasperReports Server.
Remediation
- Apply TIBCO security patches immediately. Upgrade TIBCO JasperReports Server to a patched version as specified in TIBCO's security advisory (April 17, 2018). Affected versions include JasperReports Server up to and including 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, and 6.4.2 across all product variants. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Restrict file system access for the JasperReports Server process. Run the JasperReports Server application under a dedicated service account with minimal file system permissions. Use operating system-level access controls to prevent the web application process from reading files outside its designated directories.
- Implement network-level access controls. Restrict access to the JasperReports Server interface to authorized users and trusted networks only. Use a reverse proxy or WAF to filter requests containing path traversal sequences (such as ../ and encoded variants) targeting the Spring web flows.
- Review server logs for signs of exploitation. Examine web server access logs for requests containing directory traversal patterns targeting JasperReports endpoints. Check for unauthorized access to configuration files (such as application properties, database connection strings, and credentials files).
- Audit and rotate exposed credentials. Since the vulnerability enables read access to configuration files, assume that any credentials stored on the JasperReports Server host may have been compromised. Rotate database passwords, API keys, and any other sensitive values stored in accessible configuration files.
Technical Details
CVE-2018-5430 exploits improper path limitation (CWE-22) combined with information exposure (CWE-200) in the Spring web flows of TIBCO JasperReports Server. The vulnerability mechanism allows authenticated users to manipulate file path parameters within the Spring web flow endpoints to traverse beyond the intended application directory structure, gaining read access to arbitrary files on the host system. The network-based attack vector (AV:N) means exploitation requires only HTTP access to the JasperReports Server web interface. Low attack complexity (AC:L) indicates that the path traversal can be performed through straightforward HTTP request manipulation without requiring special timing or environmental conditions. The requirement for low privileges (PR:L) means any valid JasperReports user account — even one with minimal reporting permissions — is sufficient to exploit the flaw. The combination of CWE-22 and CWE-200 is particularly dangerous because the path traversal provides the attack mechanism while the information exposure captures the resulting impact: sensitive configuration files, database credentials, and internal system details become accessible to any authenticated user.
Frequently Asked Questions
Is CVE-2018-5430 being actively exploited?
Yes, CVE-2018-5430 is actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of January 19, 2023. Public exploit code is available on Exploit-DB, and the EPSS score of 41.4% (97.32nd percentile) confirms significant exploitation probability.
What products are affected by CVE-2018-5430?
CVE-2018-5430 affects multiple TIBCO products: JasperReports Server (versions up to 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.2), JasperReports Server Community Edition (up to 6.4.2), JasperReports Server for ActiveMatrix BPM (up to 6.4.2), Jaspersoft for AWS with Multi-Tenancy (up to 6.4.2), and Jaspersoft Reporting and Analytics for AWS (up to 6.4.2).
How do I fix CVE-2018-5430?
Upgrade to a patched version of TIBCO JasperReports Server as specified in TIBCO's April 2018 security advisory. Additionally, restrict file system permissions for the JasperReports Server process, deploy WAF rules to block path traversal attempts, and rotate any credentials that may have been exposed. See the Remediation section for detailed steps.
How severe is CVE-2018-5430?
CVE-2018-5430 is rated High severity with a CVSS v3.1 score of 8.8 out of 10. It allows any authenticated user to read arbitrary files from the host system, including sensitive configuration files. The combination of network-based remote exploitation, low attack complexity, and high impact across all CIA triad categories makes this a serious vulnerability requiring immediate attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.