$ cve CVE-2018-18815 JSON

CVE-2018-18815

10.0

CRITICAL · CVSS 3.0 · EPSS 3.1% (pctl 88)

In your normal cycle

Critical by CVSS (10), but no sign of active exploitation.

Description

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability that theoretically allows unauthenticated users to bypass authorization checks for portions of the HTTP interface to the JasperReports Server. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, and TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

Scoring

CVSS	10.0 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	3.13% — more likely to be exploited than 88% of all CVEs
Weakness	CWE-863
On CISA KEV	no
Public exploit	none known
Published	2019-03-07
Last modified	2026-06-17

Affected (3)

Vendor	Product
tibco	jasperreports server
tibco	jaspersoft
tibco	jaspersoft reporting and analytics

References

→ the Explorer · watch your stack · NVD