What’s Vulnerable › Vulnerabilities

CVE-2018-18808: TIBCO JasperReports Server Privilege Escalation Via Race Condition

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-07 · updated 2026-06-17
• Weakness: CWE-362

Description

The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Affected products

• TIBCO JasperReports Server: through 6.3.4; through 6.4.3; through 7.1.0; 6.4.0, 6.4.1, 6.4.2, 6.4.3, 7.1.0
• TIBCO Jaspersoft: through 7.1.0
• TIBCO Jaspersoft Reporting And Analytics: through 7.1.0

References

• http://www.securityfocus.com/bid/107350
• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18808
• http://www.securityfocus.com/bid/107350
• http://www.tibco.com/services/support/advisories
• https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18808

Get alerted when CVE-2018-18808 or the next vulnerability affects your stack