CVE-2018-5431

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2018
Source publication: Apr 17, 2018
Source updated: Sep 17, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

TIBCO JasperReports Server Cross Site Scripting Vulnerability

The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which may allow, in the context of a non-default permissions configuration, persisted cross-site scripting (XSS) attacks. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

TIBCO JasperReports Server

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.2.4	None listed
6.3.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.3.2	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.3.3	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.4.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
6.4.2	`affected`	Unavailable	Unavailable	Unavailable	None listed

TIBCO JasperReports Server Community Edition

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server Community Edition
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server Community Edition · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.4.2	None listed

TIBCO JasperReports Server for ActiveMatrix BPM

Vendor: TIBCO Software Inc.
Product: TIBCO JasperReports Server for ActiveMatrix BPM
Platforms: Unknown
Default status: Unknown

TIBCO JasperReports Server for ActiveMatrix BPM · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.4.2	None listed

TIBCO Jaspersoft for AWS with Multi-Tenancy

Vendor: TIBCO Software Inc.
Product: TIBCO Jaspersoft for AWS with Multi-Tenancy
Platforms: Unknown
Default status: Unknown

TIBCO Jaspersoft for AWS with Multi-Tenancy · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.4.2	None listed

TIBCO Jaspersoft Reporting and Analytics for AWS

Vendor: TIBCO Software Inc.
Product: TIBCO Jaspersoft Reporting and Analytics for AWS
Platforms: Unknown
Default status: Unknown

TIBCO Jaspersoft Reporting and Analytics for AWS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	Unavailable	6.4.2	None listed