What’s Vulnerable › Vulnerabilities

CVE-2018-5431: TIBCO JasperReports Server Cross Site Scripting Vulnerability

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-17 · updated 2026-06-17
• Weakness: CWE-79

Description

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Affected products

• TIBCO JasperReports Server: through 6.2.4; through 6.4.2; 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.2
• TIBCO Jaspersoft: through 6.4.2
• TIBCO Jaspersoft Reporting And Analytics: through 6.4.2

References

• https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5431
• https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5431

Get alerted when CVE-2018-5431 or the next vulnerability affects your stack