---
id: "CVE-2018-5430"
kind: "vulnerability"
aliases: ["CVE-2018-5430"]
title: "The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community\u2026"
severity: "high"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "TIBCO JasperReports", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "<= 6.2.4", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "<= 6.4.2", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "= 6.3.0", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "= 6.3.2", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "= 6.3.3", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "= 6.4.0", "ecosystem": "vendor"}, {"name": "tibco jasperreports server", "fixed": [], "affected": "= 6.4.2", "ecosystem": "vendor"}, {"name": "tibco jaspersoft", "fixed": [], "affected": "<= 6.4.2", "ecosystem": "vendor"}, {"name": "tibco jaspersoft reporting and analytics", "fixed": [], "affected": "<= 6.4.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "jasperreports-server", "package", "self-hosted", "tibco"]
not_affected_if: ["auth-required"]
published_at: "2018-04-17T18:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-5430", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5430", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community…

TIBCO JasperReports Server has a flaw that lets any logged-in user read the web application's contents, including key configuration files. An attacker with a normal user account can read secrets stored in those files.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TIBCO JasperReports affected ? fixed ?
- vendor:tibco jasperreports server affected <= 6.2.4 fixed ?
- vendor:tibco jasperreports server affected <= 6.4.2 fixed ?
- vendor:tibco jasperreports server affected = 6.3.0 fixed ?
- vendor:tibco jasperreports server affected = 6.3.2 fixed ?
- vendor:tibco jasperreports server affected = 6.3.3 fixed ?
- vendor:tibco jasperreports server affected = 6.4.0 fixed ?
- vendor:tibco jasperreports server affected = 6.4.2 fixed ?
- vendor:tibco jaspersoft affected <= 6.4.2 fixed ?
- vendor:tibco jaspersoft reporting and analytics affected <= 6.4.2 fixed ?

## Fix

Apply the vendor update per TIBCO's instructions; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-5430
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-5430

## From the sources

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_