Is CVE-2018-5430 actively exploited?

Yes. CVE-2018-5430 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2018-5430 be exploited remotely?

The attack vector of CVE-2018-5430 has not been classified yet.

What is the CVSS score of CVE-2018-5430?

CVE-2018-5430 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2018-5430

HIGHCISA KEVIN THE WILD

CVE-2018-5430

Published: December 29, 2022

EPSS:41.42%probability of exploitation in 30 daysPercentile:97.3th

Official Description

TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

NVD Source

CISA KEV Advisory

TIBCO JasperReports Server Information Disclosure Vulnerability

TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

Added to KEV: 2022-12-29Federal patch deadline: 2023-01-19

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

A vulnerability in TIBCO JasperReports Server grants any authenticated user read-only access to sensitive web application contents, including configuration files. With an EPSS score of 0.41417 and inclusion in CISA's KEV, this vulnerability is actively exploited, indicating a significant risk of information disclosure.

This vulnerability is actively exploited in the wild and is listed in CISA's KEV. Exploitation requires prior authentication, but once authenticated, an attacker can remotely access sensitive information.

Recommended Action

Apply the latest security patches and updates for TIBCO JasperReports Server. Review and strengthen access controls for authenticated users to ensure least privilege principles are enforced.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2018-5430 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2018-5430 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.