Aspera Console Vulnerability: Remote Attacker Could Access Sensitive Information

CVE-2022-43845

What is CVE-2022-43845?

A vulnerability has been identified in IBM Aspera Console versions 3.4.0 through 3.4.4 that allows for the potential exposure of sensitive information. This issue arises from a failure to properly configure the HTTPOnly flag on cookies, leaving them accessible to malicious scripts. By exploiting this vulnerability, an attacker can remotely harvest sensitive data stored in the affected cookies, which may include session tokens or personal information. It is critical for users of the affected versions to apply security updates and configure their settings to mitigate the risk of unauthorized access.

References