mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-08 22:18:26 +00:00
Merge branch 'TIBCO_Jaspersoft_March_2019' of https://github.com/TIBCOSoftware/cvelist into TIBCOSoftware-TIBCO_Jaspersoft_March_2019
This commit is contained in:
CVE Team
commit
e838a71eac
@ -1,8 +1,98 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ASSIGNER" : "security@tibco.com",
|
||||
"DATE_PUBLIC" : "2019-03-06T17:00:00.000Z",
|
||||
"ID" : "CVE-2018-18808",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "TIBCO JasperReports Server Privilege Escalation Via Race Condition"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.3.4"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.3"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server Community Edition",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft for AWS with Multi-Tenancy",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft Reporting and Analytics for AWS",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
@ -11,8 +101,55 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The domain management component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a race-condition vulnerability that may allow any users with domain save privileges to gain superuser privileges.\n\nAffected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 8.8,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "UNCHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "The impact of this vulnerability includes the theoretical possibility of gaining system admin access to the JasperReports Server process."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18808"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\nTIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\nTIBCO JasperReports Server version 7.1.0 update to version 7.1.1 or higher\n\nTIBCO JasperReports Server Community Edition versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher\n\nTIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below update to version 7.1.1 or higher\n"
|
||||
}
|
||||
],
|
||||
"source" : {
|
||||
"discovery" : "USER"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,9 +1,162 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ASSIGNER" : "security@tibco.com",
|
||||
"DATE_PUBLIC" : "2019-03-06T17:00:00.000Z",
|
||||
"ID" : "CVE-2018-18809",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "TIBCO JasperReports Library Directory Traversal Vulnerability"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Library",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.3.4"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.21"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Library Community Edition",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.7.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Library for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.21"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.3.4"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.3"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server Community Edition",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft for AWS with Multi-Tenancy",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft Reporting and Analytics for AWS",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO would like to extend its appreciation to Elar Lang of Clarified Security and Sathish Kumar Balakrishnan from Cyber Security Works Pvt Ltd for discovery of this vulnerability.\n"
|
||||
}
|
||||
],
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
@ -11,8 +164,55 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system.\nAffected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server:\n versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 9.9,
|
||||
"baseSeverity" : "CRITICAL",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Library versions 6.3.4 and below update to version 6.3.5 or higher\nTIBCO JasperReports Library versions 6.4.1, 6.4.2, and 6.4.21 update to version 6.4.22 or higher\nTIBCO JasperReports Library version 7.1.0 update to version 7.1.1 or higher\nTIBCO JasperReports Library version 7.2.0 update to version 7.2.1 or higher\n\nTIBCO JasperReports Library Community Edition versions 6.7.0 and below update to version 6.7.1 or higher\n\nTIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.21 and below update to version 6.4.22 or higher\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\nTIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\nTIBCO JasperReports Server version 7.1.0 update to version 7.1.1 or higher\n\nTIBCO JasperReports Server Community Edition versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher\n\nTIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below update to version 7.1.1 or higher\n"
|
||||
}
|
||||
],
|
||||
"source" : {
|
||||
"discovery" : "EXTERNAL"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,9 +1,101 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ASSIGNER" : "security@tibco.com",
|
||||
"DATE_PUBLIC" : "2019-03-06T17:00:00.000Z",
|
||||
"ID" : "CVE-2018-18815",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "TIBCO JasperReports Server User Information Disclosure"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.3"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server Community Edition",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft for AWS with Multi-Tenancy",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft Reporting and Analytics for AWS",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO would like to extend its appreciation to Steven Seeley (mr_me) of Source Incite working with Trend Micro Zero Day Initiative for discovery of this vulnerability.\n"
|
||||
}
|
||||
],
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
@ -11,8 +103,61 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server.\n\nAffected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 10,
|
||||
"baseSeverity" : "CRITICAL",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "NONE",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "The impact of this vulnerability includes the theoretical possibility of unauthenticated read access to the contents of the host system, when combined with the vulnerability identified by CVE-2018-18809."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-18815"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809"
|
||||
},
|
||||
{
|
||||
"url" : "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18809"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\nTIBCO JasperReports Server version 7.1.0 update to version 7.1.1 or higher\n\nTIBCO JasperReports Server Community Edition versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher\n\nTIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below update to version 7.1.1 or higher\n"
|
||||
}
|
||||
],
|
||||
"source" : {
|
||||
"discovery" : "EXTERNAL"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,8 +1,98 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ASSIGNER" : "security@tibco.com",
|
||||
"DATE_PUBLIC" : "2019-03-06T17:00:00.000Z",
|
||||
"ID" : "CVE-2018-18816",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "TIBCO JasperReports Persistent Cross Site Scripting Vulnerability"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.3.4"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.3"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server Community Edition",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft for AWS with Multi-Tenancy",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO Jaspersoft Reporting and Analytics for AWS",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "7.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
@ -11,8 +101,55 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The repository component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS contains a persistent cross site scripting vulnerability.\n\nAffected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-\nTenancy versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 8,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "UNCHANGED",
|
||||
"userInteraction" : "REQUIRED",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "The impact of this vulnerability includes the theoretical possibility that a malicious actor could gain full access to the web interface of the affected component."
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-2018-18816"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\nTIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\nTIBCO JasperReports Server version 7.1.0 update to version 7.1.1 or higher\n\nTIBCO JasperReports Server Community Edition versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher\n\nTIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below update to version 7.1.1 or higher\n\nTIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below update to version 7.1.1 or higher\n"
|
||||
}
|
||||
],
|
||||
"source" : {
|
||||
"discovery" : "USER"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,9 +1,68 @@
|
||||
{
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ASSIGNER" : "security@tibco.com",
|
||||
"DATE_PUBLIC" : "2019-03-06T17:00:00.000Z",
|
||||
"ID" : "CVE-2019-8986",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "TIBCO JasperReports Server XML Entity Expansion Vulnerability"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.3.4"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.0"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.1"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.2"
|
||||
},
|
||||
{
|
||||
"affected" : "=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "TIBCO JasperReports Server for ActiveMatrix BPM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_value" : "6.4.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "TIBCO Software Inc."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO would like to extend its appreciation to Julien Szlamowicz and Sebastien Dudek of Synacktiv for discovery of this vulnerability."
|
||||
}
|
||||
],
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
@ -11,8 +70,55 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system.\n\nAffected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3. "
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "NONE",
|
||||
"baseScore" : 7.7,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "NONE",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "foo"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "http://www.tibco.com/services/support/advisories"
|
||||
},
|
||||
{
|
||||
"url" : "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"
|
||||
}
|
||||
]
|
||||
},
|
||||
"solution" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\n TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher\n"
|
||||
}
|
||||
],
|
||||
"source" : {
|
||||
"discovery" : "EXTERNAL"
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user