// For flags

CVE-2019-8986

TIBCO JasperReports Server XML Entity Expansion Vulnerability

Severity Score

7.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3.

La vulnerabilidad del API del componente SOAP de TIBCO JasperReports Server y TIBCO JasperReports Server for ActiveMatrix BPM de TIBCO Software Inc. contiene una vulnerabilidad que podría permitir a un usuario autenticado malicioso copiar archivos de texto desde el sistema operativo host. Las versiones afectadas de los productos de TIBCO Software Inc. son TIBCO JasperReports Server: hasta e incluyendo las versiones 6.3.4, 6.4.0, 6.4.1, 6.4.2 y 6.4.3; TIBCO JasperReports Server for Active Matrix BPM: hasta e incluyendo la versión 6.4.3.

*Credits: TIBCO would like to extend its appreciation to Julien Szlamowicz and Sebastien Dudek of Synacktiv for discovery of this vulnerability.
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-02-21 CVE Reserved
  • 2019-03-07 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 <= 6.3.4
Search vendor "Tibco" for product "Jasperreports Server" and version " <= 6.3.4"
-
Affected
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 <= 6.4.3
Search vendor "Tibco" for product "Jasperreports Server" and version " <= 6.4.3"
activematrix_bpm
Affected
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 6.4.0
Search vendor "Tibco" for product "Jasperreports Server" and version "6.4.0"
-
Affected
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 6.4.1
Search vendor "Tibco" for product "Jasperreports Server" and version "6.4.1"
-
Affected
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 6.4.2
Search vendor "Tibco" for product "Jasperreports Server" and version "6.4.2"
-
Affected
Tibco
Search vendor "Tibco"
 Jasperreports Server
Search vendor "Tibco" for product "Jasperreports Server"
 6.4.3
Search vendor "Tibco" for product "Jasperreports Server" and version "6.4.3"
-
Affected