SecurinZero Days
    Email Us
    Zero-Day Research/CVE-2018-18809
    ▲ MediumCVSS 6.5✓ Patched⚑ KEV-listedEPSS 0.93909%

    Directory Traversal Vulnerability in TIBCO JasperReports Library

    The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO Jaspersoft for AWS with Multi-Tenancy contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system.

    CVE IDCVE-2018-18809
    CVSS v3.16.5 Medium
    VendorTIBCO
    CWECWE-22
    DisclosedOct 15, 2018
    StatusFixed
    All advisories
    • 01Description
    • 02Proof of Concept
    • 03Impact
    • 04Remediation
    • 05Timeline
    • 06References
    01/Description

    What this actually is.

    Technical background, root cause, and affected surface.

    The directory traversal vulnerability may theoretically allow web server users to access the contents of the host system.

     

    *Affected Products: TIBCO JasperReports Library versions 6.3.4 and below, TIBCO JasperReports Library versions 6.4.1, 6.4.2, and 6.4.21, TIBCO JasperReports Library version 7.1.0, TIBCO JasperReports Library version 7.2.0, TIBCO JasperReports Library Community Edition versions 6.7.0 and below,TIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.21 and below, TIBCO JasperReports Server versions 6.3.4 and below TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3, TIBCO JasperReports Server version 7.1.0, TIBCO JasperReports Server Community Edition versions 6.4.3 and below, TIBCO JasperReports Server Community Edition version 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below ,TIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below

    Vendor
    TIBCO
    Affected Product
    See Full List Below*
    CVE
    CVE-2018-18809
    Securin ID
    2018-CSW-02-1018
    Status
    Fixed
    Date
    October 15, 2018
    Severity
    Medium
    CVSS Score
    6.5
    Vector
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    CWE
    CWE-22
    02/Proof of Concept

    From one request
    to root shell.

    Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.

    6.5CVSS 3.1
    VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    ScopeUnchanged
    ImpactC:H / I:N / A:N
    ExploitPublic · Confirmed in wild
    PoC · Exploitation Steps▲ trigger
    01This vulnerability was tested in TIBCO Jaspersoft.02Figure 01: Actual Request.03Figure02: Variable Injected with payload 01.04Figure 03: Variable Injected with payload 02.05Figure 04: Seps to reproduce.
    03/Impact

    What an attacker does to you.

    Post-exploitation outcomes mapped to CVSS impact metrics.

    The impact of this vulnerability includes the theoretical possibility that a web server using the provided DefaultWebResourceHandler could expose details of the host system. The disclosed data could include credentials to access other systems.

    04/Remediation

    Fix it. In this order.

    A runbook, not a checklist. Sequence matters — assume compromise before you act.

    01

    TIBCO JasperReports Library versions 6.3.4 and below update to version 6.3.5 or higher

    N/A
    02

    TIBCO JasperReports Library versions 6.4.1, 6.4.2, and 6.4.21 update to version 6.4.22 or higher

    N/A
    03

    TIBCO JasperReports Library version 7.1.0 update to version 7.1.1 or higher

    N/A
    04

    TIBCO JasperReports Library version 7.2.0 update to version 7.2.1 or higher

    N/A
    05

    TIBCO JasperReports Library Community Edition versions 6.7.0 and below update to version 6.7.1 or higher

    N/A
    06

    TIBCO JasperReports Library for ActiveMatrix BPM versions 6.4.21 and below update to version 6.4.22 or higher

    N/A
    07

    TIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher

    N/A
    08

    TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher

    N/A
    09

    TIBCO JasperReports Server version 7.1.0 update to version 7.1.1 or higher

    N/A
    10

    TIBCO JasperReports Server Community Edition versions 7.1.0 and below update to version 7.1.1 or higher

    N/A
    11

    TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher

    N/A
    12

    TIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below update to version 7.1.1 or higher

    N/A
    13

    TIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below update to version 7.1.1 or higher

    N/A

    Download and apply the following patch advised as per TIBCO for the affected system, update to the corresponding software versions:

    Securin advisory — For coordinated remediation support or threat-actor briefings related to CVE-2018-18809, contact disclose@securin.io
    05/Disclosure Timeline

    Vendors moved in days.
    Attackers in hours.

    Reconstructed from vendor advisories, CISA bulletins, and Securin research records.

    Oct 15, 2018

    Discovered in Tibco.

    Jan 11, 2019

    The issue was under investigation.

    Mar 06, 2019

    TIBCO Security Advisory Published.

    Apr 26, 2019

    Demo site fixed and updated.

    Disclosed 142 days after discovery · Listed in CISA Known Exploited Vulnerabilities

    06/References

    Cite, verify, go deeper.

    Primary sources — NVD, CISA KEV, and machine-readable IoC feed.

    NVD

    NVD — CVE-2018-18809

    nvd.nist.gov/vuln/detail/CVE-2018-18809 →
    KEV

    CISA Known Exploited Vulnerabilities Catalog

    cisa.gov/known-exploited-vulnerabilities-catalog →
    SEC

    Securin VI — Full Technical Analysis

    vi.securin.io →

    Let Securin level up your security posture.

    Get a live exposure assessment, threat-actor briefing tailored to your sector, and IoC mapping for your SIEM.

    Browse all advisories
    SecurinSecurinZero Days

    Securin's zero-day research operation combines frontier AI models with a decade of offensive expertise — discovering, validating, and coordinating the disclosure of high-impact vulnerabilities at a scale and speed no human team achieves alone.

    Glossary
    © 2026 Securin Inc · CVE Numbering Authority
    Privacy Policy·Data Processing Addendum