CVE-2018-18808

The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Link	Resource
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18808	Vendor Advisory
http://www.tibco.com/services/support/advisories	Vendor Advisory
http://www.securityfocus.com/bid/107350	Third Party Advisory VDB Entry

Configuration 1

cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:* cpe:2.3:a:tibco:jasperreports_server:6.4.1:*:*:*:*:*:*:* cpe:2.3:a:tibco:jasperreports_server:6.4.3:*:*:*:*:*:*:* cpe:2.3:a:tibco:jasperreports_server:7.1.0:*:*:*:*:*:*:* cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:* cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:* cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*

---

Published : 2019-03-07 10:29

Updated : 2019-10-09 11:37

---

NVD link : CVE-2018-18808

Mitre link : CVE-2018-18808

No products.

CWE-362