CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

• CWE-22
• CWE-200

• https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44623/Exploit, Third Party Advisory, VDB Entry
• https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430Broken Link, Vendor Advisory
• https://rhinosecuritylabs.com/application-security/authenticated-file-read-vulnerability-in-jasperreports/Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/44623/Exploit, Third Party Advisory, VDB Entry
• https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430Broken Link, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-5430US Government Resource

Published

Apr 17, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5424Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-5425Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-5426Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-5427Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-5428The version control adapters component of TIBCO Data Virtual…8.8
• CVE-2018-5429A vulnerability in the report scripting component of TIBCO S…8.8
• CVE-2018-5431The domain designer component of TIBCO Software Inc.'s TIBCO…6.3
• CVE-2018-5432The TIBCO Administrator server component of of TIBCO Softwar…8
• CVE-2018-5433The TIBCO Administrator server component of TIBCO Software I…6.5
• CVE-2018-5434The TIBCO Designer component of TIBCO Software Inc.'s TIBCO …5.8
• CVE-2018-5435The TIBCO Spotfire Client and TIBCO Spotfire Web Player Clie…9.6
• CVE-2018-5436The Spotfire server component of TIBCO Software Inc.'s TIBCO…6.5