US CISAĀ addedĀ TIBCO Softwareās JasperReports vulnerabilities to its Known Exploited Vulnerabilities Catalog.
US CISAĀ addedĀ TIBCO Softwareās JasperReports vulnerabilities, tracked asĀ CVE-2018-5430Ā (CVSS score: 7.7) andĀ CVE-2018-18809Ā (CVSS score: 9.9), to its Known Exploited Vulnerabilities (KEV) catalog,.
TIBCO JasperReportsĀ is anĀ open-sourceĀ JavaĀ reportingĀ tool for creating and managing reports and dashboards.
According toĀ Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review theĀ CatalogĀ and address the vulnerabilities in their infrastructure.
Below are the vulnerabilities added to the catalog:
- CVE-2018-5430 ā TIBCO JasperReports Server contains a vulnerability that may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
- CVE-2018-18809 ā TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
US Federal agencies have to address these vulnerabilities in their systems by January 19, 2023.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
|
|
(SecurityAffairsĀ ā hacking, CISA)
The post CISA adds JasperReports vulnerabilities to its Known Exploited Vulnerabilities Catalog appeared first on Security Affairs.