CVE-2019-8986

TIBCO JasperReports Server XML Entity Expansion Vulnerability

High · published March 7, 2019

CVSS v3.0
7.7
EPSS
1%
Percentile
63.7
In the wild
Unconfirmed
What it is

The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3.

The record
Technical detail
CVSS v3.0
7.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01039 · 63.7th percentile
Published
2019-03-07T22:00Z
EPSS history
Timeline
  • 07 MAR 22:00Z
    TIBCO JasperReports Server XML Entity Expansion Vulnerability
    cvelistv5