https://bugzilla.redhat.com/show_bug.cgi?id=1570973
Bug ID: 1570973
Summary: CVE-2018-5430 jasperreports: read-only access to the
contents of the web application for authenticated user
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
rhel8-maint(a)redhat.com
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO
JasperReports Server Community Edition, TIBCO JasperReports Server for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO
Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may
allow any authenticated user read-only access to the contents of the web
application, including key configuration files. Affected releases include TIBCO
Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4;
6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition:
versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix
BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with
Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting
and Analytics for AWS: versions up to and including 6.4.2.
References:
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.