CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2018-04-17
TIBCO JasperReports Server Spring Web Flow Arbitrary File Read and Information Disclosure (CVE-2018-5430)
[Affected Scope] TIBCO JasperReports Server versions up to and including 6.2.4, 6.3.0, 6.3.2, 6.3.3, 6.4.0, 6.4.2, and related Community/AWS/BPM editions
[Impact] Authenticated attackers can exploit Spring Web Flow parameter handling to gain unauthorized read-only access to sensitive web application configuration files, including database credentials
[Mitigation] Apply official security patches from TIBCO, upgrade to the latest stable release, or implement strict input validation and WAF rules to block path traversal patterns