Vulnerability record

CVE-2018-5430

TIBCO JasperReports Server Information Disclosure Vulnerability

HighExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run JasperReports, fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Jan 19, 2023.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Source
JasperReports	TIBCO	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog. Version details have not been published yet.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2018-5430 scored CVSS 8.8: TIBCO JasperReports, TIBCO JasperReports Server Information Disclosure Vulnerability
CISA lists this as exploited in the wild. Unpatched JasperReports systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

tibco.com https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-201…
nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2018-5430
rhinosecuritylabs.com https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/
exploit-db.com https://www.exploit-db.com/exploits/44623/
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430