CVE-2018-18808high

CVE-2018-18808: fallo de gravedad alta en TIBCO JasperReports Server

TIBCO JasperReports Server Privilege Escalation Via Race Condition

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear TIBCO JasperReports Server+ Monitorear TIBCO JasperReports Server for ActiveMatrix BPM

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 1.7%
The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
TIBCO Software Inc. · TIBCO JasperReports ServerTIBCO Software Inc. · TIBCO JasperReports Server Community EditionTIBCO Software Inc. · TIBCO JasperReports Server for ActiveMatrix BPMTIBCO Software Inc. · TIBCO Jaspersoft for AWS with Multi-TenancyTIBCO Software Inc. · TIBCO Jaspersoft Reporting and Analytics for AWS
CVEs relacionadas — TIBCO JasperReports Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2018-18809CRITICALTIBCO JasperReports Library Directory Traversal VulnerabilityEPSS 79.1%KEVCVE-2018-5430HIGHTIBCO JasperReports Server Information Disclosure VulnerabilityEPSS 48.1%KEVCVE-2020-9410HIGHTIBCO JasperReports LibraryEPSS 5.4%CVE-2020-9409CRITICALTIBCO JasperReports Server Fails To Enforce Access RestrictionsEPSS 3.5%CVE-2018-18815CRITICALTIBCO JasperReports Server User Information DisclosureEPSS 3.1%CVE-2022-22771CRITICALTIBCO JasperReports Library Directory Traversal VulnerabilityEPSS 2.4%