Aspera Console Vulnerability: Remote Attacker Could Access Sensitive Information
CVE-2022-43845

7.5HIGH

Key Information:

Vendor
IBM
Status
Aspera Console
Vendor
CVE Published:
25 September 2024

Summary

A vulnerability has been identified in IBM Aspera Console versions 3.4.0 through 3.4.4 that allows for the potential exposure of sensitive information. This issue arises from a failure to properly configure the HTTPOnly flag on cookies, leaving them accessible to malicious scripts. By exploiting this vulnerability, an attacker can remotely harvest sensitive data stored in the affected cookies, which may include session tokens or personal information. It is critical for users of the affected versions to apply security updates and configure their settings to mitigate the risk of unauthorized access.

Affected Version(s)

Aspera Console 3.4.0 <= 3.4.4

References

https://www.ibm.com/support/pages/node/7169766
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.