Skip to main content
IMMUNITYSEC

CVE-2018-18809

TIBCO JasperReports Library Directory Traversal Vulnerability

9.9
CRITICAL
CVSS 3.0
EPSS 79.1% · 100th pctCISA KEV · Exploited in the wild
2019-03-07Updated 2025-10-21KEV 2022-12-29
CISA Known Exploited Vulnerabilities

TIBCO JasperReports Library Directory Traversal Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2022-12-29
Remediation due
2023-01-19

Required action
Apply updates per vendor instructions.

CISA notes
https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809

Description

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Severity

CVSS 3.0 · CNA9.9 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impacttotal

Exploitation Context

as of October 15, 2026
All KEV statistics→
  • CISA added CVE-2018-18809 to the KEV catalog 1,393 days after its CVE record was published.
  • It is one of 2 TIBCO entries in the CISA KEV catalog, and one of 2 added in 2022.
  • Its current EPSS score (79.1%) is higher than that of 63% of CISA KEV entries.

Affected Products

ProductAffected versions
TIBCO Software Inc.
TIBCO JasperReports Library
unspecified to 6.3.4
6.4.1
6.4.2
6.4.21
7.1.0
7.2.0
TIBCO Software Inc.
TIBCO JasperReports Library Community Edition
unspecified to 6.7.0
TIBCO Software Inc.
TIBCO JasperReports Library for ActiveMatrix BPM
unspecified to 6.4.21
TIBCO Software Inc.
TIBCO JasperReports Server
unspecified to 6.3.4
6.4.0
6.4.1
6.4.2
6.4.3
7.1.0
TIBCO Software Inc.
TIBCO JasperReports Server Community Edition
unspecified to 6.4.3
7.1.0
TIBCO Software Inc.
TIBCO JasperReports Server for ActiveMatrix BPM
unspecified to 6.4.3
TIBCO Software Inc.
TIBCO Jaspersoft for AWS with Multi-Tenancy
unspecified to 7.1.0
TIBCO Software Inc.
TIBCO Jaspersoft Reporting and Analytics for AWS
unspecified to 7.1.0

References

7 Links
Vulnerability databases

Record Details

Published
2019-03-07
Last updated
2025-10-21
Assigner (CNA)
tibco
Credited to
TIBCO would like to extend its appreciation to Elar Lang of Clarified Security and Sathish Kumar Balakrishnan from Cyber Security Works Pvt Ltd for discovery of this vulnerability.

More from TIBCO Software Inc.

CVE-2018-54307.7 HIGH

TIBCO JasperReports Server Information Disclosure Vulnerability

TIBCO Software Inc.KEVEPSS 48.1%2018-04-17

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.