Aspera Faspex vulnerable to Cross-Site Scripting (XSS)
CVE-2023-37411

5.4MEDIUM

Key Information:

Vendor
IBM
Status
Aspera Faspex
Vendor
CVE Published:
28 May 2024

Summary

IBM Aspera Faspex versions 5.0.0 through 5.0.6 are affected by a cross-site scripting vulnerability that allows an attacker to embed arbitrary JavaScript code in the web user interface. This exploitation can alter the intended functionality of the application and may result in unauthorized access to user credentials during trusted sessions. Preventive measures should be taken to secure applications against such vulnerabilities.

Affected Version(s)

Aspera Faspex 5.0.0 <= 5.0.6

References

https://www.ibm.com/support/pages/node/7154977
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/260139
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.