CVE-2018-5430: TIBCO JasperReports Server Information Disclosure Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 29 Dec 2022, 1,717 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 48.1%
EPSS score, percentile 98.9 of all scored records
- How severe?
- 7.7 High
CVSS v3.0 base score, given by the CNA
- What should I do?
Required action (CISA), due 19 Jan 2023: Apply updates per vendor instructions.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected: 6.2.4 and earlier; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.2; 6.4.2 and earlier; 6.4.2 and earlier; 6.4.2 and earlier; 6.4.2 and earlier
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply updates per vendor instructions.
CISA due date for this action: 19 January 2023.
Solution (from the CVE record)
TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions: TIBCO JasperReports Server versions 6.2.4 and below update to version 6.2.5 or higher TIBCO JasperReports Server versions 6.3.0, 6.3.2, and 6.3.3 update to version 6.3.4 or higher TIBCO JasperReports Server versions 6.4.0 and 6.4.2 update to version 6.4.3 or higher TIBCO JasperReports Server Community Edition versions 6.4.2 and below update to version 6.4.3 or higher TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.2 and below update to version 6.4.3 or higher TIBCO Jaspersoft for AWS with Multi-Tenancy versions 6.4.2 and below update to version 6.4.3 or higher TIBCO Jaspersoft Reporting and Analytics for AWS versions 6.4.2 and below update to version 6.4.3 or higher
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430
- https://nvd.nist.gov/vuln/detail/CVE-2018-5430
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | 6.2.4 and earlier |
| Affected | 6.3.0 |
| Affected | 6.3.2 |
| Affected | 6.3.3 |
| Affected | 6.4.0 |
| Affected | 6.4.2 |
| Status | Versions |
|---|---|
| Affected | 6.4.2 and earlier |
| Status | Versions |
|---|---|
| Affected | 6.4.2 and earlier |
| Status | Versions |
|---|---|
| Affected | 6.4.2 and earlier |
| Status | Versions |
|---|---|
| Affected | 6.4.2 and earlier |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2018-5430 to its Known Exploited Vulnerabilities (KEV) catalog on 29 Dec 2022.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 19 Jan 2023.
- The CVE record was published on 17 Apr 2018, 1,717 days before it was added to KEV.
- The CVE record carries a CVSS v3.0 base score of 7.7 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 48.1% (percentile 98.9), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact partial.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
TIBCO JasperReports Server Information Disclosure Vulnerability
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 17 Apr 2018 | CVE record published |
| 29 Dec 2022 | Added to CISA KEV |
| 19 Jan 2023 | CISA due date for the required action |
| 21 Oct 2025 | CVE record last updated |
References
More exploited TIBCO vulnerabilities
- CVE-2018-18809: TIBCO JasperReports Library Directory Traversal Vulnerability