December 30, 2022Rabbi Lakshmananpatch management

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Added A two-year-old security flaw affecting known and exploited vulnerabilities in TIBCO Software’s JasperReports product (KEV) catalog, citing evidence of active exploitation.

defects tracked as CVE-2018-5430 (CVSS score: 7.7) and CVE-2018-18809 (CVSS score: 9.9), addressed by TIBCO in April 2018 and March 2019, respectively.

Tibuco jasper report A Java-based reporting and data analysis platform for creating, distributing, and managing reports and dashboards.

cyber security

The first of the two issues, CVE-2018-5430, is Information leak bug A server component that allows authenticated users to obtain read-only access to any file containing key configurations.

JasperReports vulnerability

“This impact includes the possibility of read-only access by authenticated users to web application configuration files containing credentials used by the server,” TIBCO said at the time. “These credentials may be used to influence external systems accessed by the JasperReports server.”

On the other hand, CVE-2018-18809 is Directory Traversal Vulnerability The JasperReports library could allow a web server user to access sensitive files on the host, allowing an attacker to steal credentials and compromise other systems.

CISA has not disclosed any additional details about how the vulnerability would be weaponized in an actual attack. US federal agencies have until January 19, 2023 to patch their systems.

Did you find this article interesting?Please follow us twitter When LinkedIn To read more exclusive content that we post.



Register now for our membership to gain access to our elite training program and fast forward your career today!


Subscribe my Newsletter for new blog posts, tips & new photos. Let's stay updated!

Security Blog

Blue Training Academy

Blue Training Academy was developed in 2018 as a educational and training facility for continuing education and certification courses. Blue Training Academy is an educational institution that allows for all sectors of the public and Criminal Justice field to gain ongoing training and education.

Copyright ©️ All rights reserved. | Blue Training Academy Blog