CVE-2018-5429

{"id": "CVE-2018-5429", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@tibco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-04-17T18:29:00.213", "references": [{"url": "https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5429", "tags": ["Vendor Advisory"], "source": "security@tibco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow analytic reports that contain scripting to perform arbitrary code execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO JasperReports Library: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library Community Edition: versions up to and including 6.4.3, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM: versions up to and including 6.4.2."}, {"lang": "es", "value": "Una vulnerabilidad en el componente de scripting de informes en TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition y TIBCO Jaspersoft Studio for ActiveMatrix BPM, de TIBCO Software Inc., podr\u00eda permitir que informes anal\u00edticos que contengan scripting realicen ejecuci\u00f3n de c\u00f3digo arbitrario. Las versiones afectadas incluyen a TIBCO JasperReports Server: versiones hasta e incluyendo la 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0 y 6.4.2; TIBCO JasperReports Server Community Edition: versiones hasta e incluyendo la 6.4.2; TIBCO JasperReports Server for ActiveMatrix BPM: versiones hasta e incluyendo la 6.4.2; TIBCO JasperReports Library: versiones hasta e incluyendo la 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.1 y 6.4.2; TIBCO JasperReports Library Community Edition: versiones hasta e incluyendo la 6.4.3; TIBCO JasperReports Library for ActiveMatrix BPM: versiones hasta e incluyendo la 6.4.2; TIBCO Jaspersoft for AWS with Multi-Tenancy: versiones hasta e incluyendo la 6.4.2; TIBCO Jaspersoft Reporting and Analytics for AWS: versiones hasta e incluyendo la 6.4.2; TIBCO Jaspersoft Studio: versiones hasta e incluyendo la 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0 y 6.4.2; TIBCO Jaspersoft Studio Community Edition: versiones hasta e incluyendo la 6.4.3; TIBCO Jaspersoft Studio for ActiveMatrix BPM: versiones hasta e incluyendo la 6.4.2, de TIBCO Software Inc."}], "lastModified": "2019-10-09T23:41:20.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83D3533B-42CF-400B-A9E2-94302E009201", "versionEndIncluding": "6.2.4"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*", "vulnerable": true, "matchCriteriaId": "F8B7F2D6-580E-490B-83F5-56F76F125BA9", "versionEndIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "41D39313-991B-43DD-B830-06BE226E3FF6", "versionEndIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FF00ED7-2B4C-4043-A061-84ADFB785C92"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0B0408C-9F3F-48A7-A8B4-379B90557E95"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D32E717A-31B1-4415-B6B9-E39FAC38E756"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B714B874-89AD-49AD-8B8D-2EEDF6804E1C"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A7A9802-61F8-45AC-B5C5-82521DF50B4F"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADDCC84-2AB8-4759-A83C-53E31C2B4C44", "versionEndIncluding": "6.2.4"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:*:activematrix_bpm:*:*", "vulnerable": true, "matchCriteriaId": "2D6E1EDB-11E7-4F2F-AD02-8CF21C721E83", "versionEndIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "7A3B8FD1-6251-474E-8481-BF30ECF52284", "versionEndIncluding": "6.4.3"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDEEB975-7721-436C-A8EF-62C91A67D5E2"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A77C998E-10BD-49CE-AA25-57D24DE782B2"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C4051E7-D4F9-4285-A7E2-BC0BA45365AA"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E28FF909-232C-4C5E-981D-BD5438FD0D28"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29FE5644-D4B9-404D-9169-2AAF87721234"}, {"criteria": "cpe:2.3:a:tibco:jasperreports_library:6.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15FC0C65-B16F-402F-B5D9-10F4EE2C06FC"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jaspersoft:*:*:*:*:*:aws_with_multi-tenancy:*:*", "vulnerable": true, "matchCriteriaId": "E45760CC-1126-49FA-B86F-1DBEB379F4D4", "versionEndIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_reporting_and_analytics:*:*:*:*:*:aws:*:*", "vulnerable": true, "matchCriteriaId": "9B604288-1622-4FA1-B48B-9F11EB1C3140", "versionEndIncluding": "6.4.2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9012FB6C-09B5-4E7E-93FA-07EEFD412DFD", "versionEndIncluding": "6.2.4"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:*:activematrix_bpm:*:*", "vulnerable": true, "matchCriteriaId": "6E46934C-3A07-4478-91D3-2374848B9637", "versionEndIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "B67854F9-91AC-430D-BC18-A804E844B2E6", "versionEndIncluding": "6.4.3"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40D22C6F-FF80-4154-AC3D-2D27987E7ACC"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEE165BF-269E-4964-8051-1AE06A911851"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15556DBC-8987-4121-AB6E-F1E70E47CA2C"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C5D48582-55FC-4D7F-8B01-A649A19A1E9B"}, {"criteria": "cpe:2.3:a:tibco:jaspersoft_studio:6.4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "098D98D0-1C9E-4F04-9F80-2BBA485CA9D7"}], "operator": "OR"}]}], "sourceIdentifier": "security@tibco.com"}