« Volver al listado

CVE-2019-8986

Estado: ModificadaAlta (7.7)—

The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Tibco — Jasperreports Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-8986",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@tibco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security@tibco.com",
      "affectedData": [
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.4"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            },
            {
              "status": "affected",
              "version": "6.4.1"
            },
            {
              "status": "affected",
              "version": "6.4.2"
            },
            {
              "status": "affected",
              "version": "6.4.3"
            }
          ]
        },
        {
          "vendor": "TIBCO Software Inc.",
          "product": "TIBCO JasperReports Server for ActiveMatrix BPM",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-07T22:29:00.540",
  "references": [
    {
      "url": "http://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@tibco.com"
    },
    {
      "url": "http://www.tibco.com/services/support/advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-server-2018-8986",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The SOAP API component vulnerability of TIBCO Software Inc.'s TIBCO JasperReports Server, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that may allow a malicious authenticated user to copy text files from the host operating system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad del API del componente SOAP de TIBCO JasperReports Server y TIBCO JasperReports Server for ActiveMatrix BPM de TIBCO Software Inc. contiene una vulnerabilidad que podría permitir a un usuario autenticado malicioso copiar archivos de texto desde el sistema operativo host. Las versiones afectadas de los productos de TIBCO Software Inc. son TIBCO JasperReports Server: hasta e incluyendo las versiones 6.3.4, 6.4.0, 6.4.1, 6.4.2 y 6.4.3; TIBCO JasperReports Server for Active Matrix BPM: hasta e incluyendo la versión 6.4.3."
    }
  ],
  "lastModified": "2026-06-17T02:42:52.383",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA214ECB-6D7B-49F5-89F8-7403E885F62B",
              "versionEndIncluding": "6.3.4"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:*:*:*:*:*:activematrix_bpm:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F0C3B25-3D6F-44AD-A7FC-20EEB27F5C99",
              "versionEndIncluding": "6.4.3"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B714B874-89AD-49AD-8B8D-2EEDF6804E1C"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAECE73B-DFCC-4C5E-8817-9783A477649A"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A7A9802-61F8-45AC-B5C5-82521DF50B4F"
            },
            {
              "criteria": "cpe:2.3:a:tibco:jasperreports_server:6.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E990A0DE-874E-48DA-8A57-51DE79122A9F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@tibco.com"
}