CVE-2019-8986

{"containers": {"cna": {"affected": [{"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.3.4", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "affected", "version": "6.4.0"}, {"status": "affected", "version": "6.4.1"}, {"status": "affected", "version": "6.4.2"}, {"status": "affected", "version": "6.4.3"}]}, {"product": "TIBCO JasperReports Server for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.4.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "TIBCO would like to extend its appreciation to Julien Szlamowicz and Sebastien Dudek of Synacktiv for discovery of this vulnerability."}], "datePublic": "2019-03-06T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "foo", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-07T21:57:01.000Z", "orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"}], "solutions": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\n TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher"}], "source": {"discovery": "EXTERNAL"}, "title": "TIBCO JasperReports Server XML Entity Expansion Vulnerability", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@tibco.com", "DATE_PUBLIC": "2019-03-06T17:00:00.000Z", "ID": "CVE-2019-8986", "STATE": "PUBLIC", "TITLE": "TIBCO JasperReports Server XML Entity Expansion Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "TIBCO JasperReports Server", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_value": "6.3.4"}, {"affected": "=", "version_affected": "=", "version_value": "6.4.0"}, {"affected": "=", "version_affected": "=", "version_value": "6.4.1"}, {"affected": "=", "version_affected": "=", "version_value": "6.4.2"}, {"affected": "=", "version_affected": "=", "version_value": "6.4.3"}]}}, {"product_name": "TIBCO JasperReports Server for ActiveMatrix BPM", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_value": "6.4.3"}]}}]}, "vendor_name": "TIBCO Software Inc."}]}}, "credit": [{"lang": "eng", "value": "TIBCO would like to extend its appreciation to Julien Szlamowicz and Sebastien Dudek of Synacktiv for discovery of this vulnerability."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "foo"}]}]}, "references": {"reference_data": [{"name": "http://www.tibco.com/services/support/advisories", "refsource": "MISC", "url": "http://www.tibco.com/services/support/advisories"}, {"name": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986", "refsource": "CONFIRM", "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"}]}, "solution": [{"lang": "en", "value": "TIBCO has released updated versions of the affected components which address these issues. For each affected system, update to the corresponding software versions:\n\nTIBCO JasperReports Server versions 6.3.4 and below update to version 6.3.5 or higher\n TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 update to version 6.4.4 or higher\n\nTIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below update to version 6.4.4 or higher"}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:31:37.500Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.tibco.com/services/support/advisories"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"}]}]}, "cveMetadata": {"assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "assignerShortName": "tibco", "cveId": "CVE-2019-8986", "datePublished": "2019-03-07T22:00:00.000Z", "dateReserved": "2019-02-21T00:00:00.000Z", "dateUpdated": "2024-09-17T03:37:40.244Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "TIBCO JasperReports Server", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.3.4", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"status": "affected", "version": "6.4.0"}, {"status": "affected", "version": "6.4.1"}, {"status": "affected", "version": "6.4.2"}, {"status": "affected", "version": "6.4.3"}]}, {"product": "TIBCO JasperReports Server for ActiveMatrix BPM", "vendor": "TIBCO Software Inc.", "versions": [{"lessThanOrEqual": "6.4.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@tibco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA214ECB-6D7B-49F5-89F8-7403E885F62B", "versionEndIncluding": "6.3.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*", "matchCriteriaId": "2F0C3B25-3D6F-44AD-A7FC-20EEB27F5C99", "versionEndIncluding": "6.4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "B714B874-89AD-49AD-8B8D-2EEDF6804E1C", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "DAECE73B-DFCC-4C5E-8817-9783A477649A", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "5A7A9802-61F8-45AC-B5C5-82521DF50B4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "E990A0DE-874E-48DA-8A57-51DE79122A9F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3."}, {"lang": "es", "value": "La vulnerabilidad del API del componente SOAP de TIBCO JasperReports Server y TIBCO JasperReports Server for ActiveMatrix BPM de TIBCO Software Inc. contiene una vulnerabilidad que podr\u00eda permitir a un usuario autenticado malicioso copiar archivos de texto desde el sistema operativo host. Las versiones afectadas de los productos de TIBCO Software Inc. son TIBCO JasperReports Server: hasta e incluyendo las versiones 6.3.4, 6.4.0, 6.4.1, 6.4.2 y 6.4.3; TIBCO JasperReports Server for Active Matrix BPM: hasta e incluyendo la versi\u00f3n 6.4.3."}], "id": "CVE-2019-8986", "lastModified": "2026-06-17T02:42:52.383", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security@tibco.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-07T22:29:00.540", "references": [{"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "http://www.tibco.com/services/support/advisories"}, {"source": "security@tibco.com", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.tibco.com/services/support/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986"}], "sourceIdentifier": "security@tibco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}