CVE-2018-18815

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2018
Source publication: Mar 7, 2019
Source updated: Sep 16, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

TIBCO JasperReports Server User Information Disclosure

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

TIBCO JasperReports Server

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
6.4.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.4.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.4.2	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.4.3	`affected`	Unavailable	Unavailable	Unavailable	None listed
7.1.0	`affected`	Unavailable	Unavailable	Unavailable	None listed

TIBCO JasperReports Server Community Edition

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server Community Edition
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server Community Edition · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	7.1.0	None listed

TIBCO JasperReports Server for ActiveMatrix BPM

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server for ActiveMatrix BPM
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server for ActiveMatrix BPM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.4.3	None listed

TIBCO Jaspersoft for AWS with Multi-Tenancy

Vendor: TIBCO Software Inc.
Product: TIBCO Jaspersoft for AWS with Multi-Tenancy
Platforms: Unknown
Default status: Unknown

TIBCO Jaspersoft for AWS with Multi-Tenancy · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	7.1.0	None listed

TIBCO Jaspersoft Reporting and Analytics for AWS

Vendor: TIBCO Software Inc.
Product: TIBCO Jaspersoft Reporting and Analytics for AWS
Platforms: Unknown
Default status: Unknown

TIBCO Jaspersoft Reporting and Analytics for AWS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	7.1.0	None listed